The link in an email points to a fake auction site page. If the user tries to log in with his or Facebook, Google and Apple credentials, they will be stolen.
It has been discovered by the cybersecurity expert Patrick Wardle. It is a variant of Pirrit, and has been designed to install itself as a Safari extension.
Zerofox cyber security experts: It runs similarly to software as-a-service (SaaS) products and it’s targeting Paypal, Apple, Amazon and other platforms. The aim is credential theft.
Trend Micro: Cybercrime spread MacOS.GMERA trojan, disguised as Stockfolio. It’s used to steal user information and it’s evolving. To date, two samples were already discovered.