In this video, our researchers demonstrate how to exploit the OS X Messages client when an unknowing victim clicks a link in a message.

Transcript

In this video we will be demonstrating how an attacker can steal the messages and attachments of a victim through the messages for OSX application. The first step of the exploitation process requires the attacker to send a message containing a malicious JavaScript link to the victim. When this message is received by the victim, a notification is shown as seen in the video. When the victim opens the message, the JavaScript URI is highlighted. As soon as the victim clicks the link, the malicious payload sent by the attacker is executed on the victim's machine from the attacker's view. As soon as the victim has clicked on the malicious link, the victim's messages and attachments are uploaded to the attackers server as seen in the video. The attacker now has the attachments and the messages database of the victim.