New FlexibleFerret Malware Chain Targets macOS With Go Backdoor

A macOS malware chain attributed to FlexibleFerret employs staged shell scripts that fetch platform-specific payloads, deploy a Go-based backdoor (CDrivers), establish persistence via a LaunchAgent, and present Chrome-style decoy prompts to harvest credentials which are exfiltrated to Dropbox; the backdoor supports system profiling, file transfer, remote command execution, and automated credential theft.