Taha Karim, from the security firm DarkMatter, told iTWire: "We followed industry-standard responsible disclosure approaches and reported the problem to Apple’s product security team.

"Apple eventually notified us that the issue was closed from their perspective, but it’s unclear whether any specific remediation action was taken."

As iTWire  reported, Karim had claimed the malware used for the attack — known as WindTale and WindTape — could get past native macOS security measures and could exfiltrate documents and also take screenshots of a victim's desktop.

Elaborating on how the malware was spread, Karim said: "This macOS malware is delivered from a specially crafted web page, sent to a victim via a link inside a spear-phishing email. Once the victim clicks on the link, the Web page will serve a zip archive of this malware for download. The Web page, if not closed, will launch the malware via a custom URL-scheme, right after the download.

"This vulnerability results from the fact that the malware custom URL-scheme is automatically added to the Apple LaunchServices database as soon as the malware touches the filesystem. On other operating systems like Microsoft Windows, extra steps are required to add a custom URL scheme : e.g., manually adding a registry key under HKEY_CLASSES_ROOT which requires admin privileges."

He said the technique also worked for network shares. "If the attacker (or end-user inadvertently) copies the malware inside a network share, all the users having this share mapped will have the custom URL scheme automatically added to their LaunchService database. Attackers could use this simple technique to move laterally inside the network resulting in the infection of a larger number of Mac computers."

Karim pointed out that Apple had implemented a user consent pop-up that would be shown the first time the app launched. "[But] unfortunately the name of the app is fully controlled by the attackers and most users can be tricked if the app name is : Safari.app, Mail.app .. making it a weak security measure," he added.

Asked about preventive measures, he said: "We advise our customers to not access their personal emails inside their corporate environment, and everyone to lock down the macOS similar to the way they have with other operating systems.

"DarkMatter will publish a hardening guide for macOS by end of September that we are urging our customers to apply. Finally, entities should block access to the domains string2me.com and flux2key.com identified as associated with these attacks.

"The identified macOS malware doesn’t have a dynamic or configurable C2 server, so for now, blocking these domains will help remediate and identify this threat. DarkMatter has already contacted all its customers with detection, remediation and disinfection routines to remove this threat from any infected macOS computer."