Hijacking the BuddyBuild installer to install a keylogger and enable remote SSH access

The demo shows a man-in-the-middle attack in action. There is a Raspberry PI in the network (attacker), and I use my Mac without any special configuration. All the attacker needs is to be in the same network, no matter if it's an open or closed network.

The attacker will do a man-in-the-middle attack to modify the BuddyBuild installer while it's being downloaded to insert malicious code.

In this video you can see how the attacker installs a keylogger on the user's Mac, and with it, enable remote SSH access, making it easy for the attack to take over control over your whole Mac. This allows the attack to access data like your full keychain, documents, source files and API keys.