In some cases, additional payloads were downloaded by the BigNox updater from attacker-controlled servers,' ESET researcher Ignacio Sanmillan said. 'We have sufficient evidence to state that BigNox’s infrastructure was compromised to host malware and also to suggest that their API infrastructure could have been compromised. To deliver the malicious payload on their targets' systems, the hacker group behind the operation dubbed NightScout compromised BigNox's storage infrastructure to store the malware and the API infrastructure to deploy the payloads. NoxPlayer is used by gamers from over 150 countries around the globe according to BigNox but, as ESET found in January 2021, the supply-chain attack was focused on infecting only Asian gamers with at least three different malware strains. ESET researchers have discovered that the updating mechanism of NoxPlayer, an Android emulator for Windows and macOS, made by Hong Kong-based company BigNox, was compromised by an unknown threat actor and used to infect gamers with malware.

Noxplayer macos