New Mac malware in the wild evades security software, researchers

Roger Fingas for AppleInsider:

Newly uncovered Mac malware is not only in the wild, but trying to avoid detection by security researchers, according to one such firm.

Dubbed “CrescentCore,” the malware comes as it usually does —in the form of a DMG file pretending to be an Adobe Flash Player installer, Intego said. If someone launches its contents, the software will check to see if it’s running inside a virtual machine — a way researchers often quarantine their subjects.

The malware also checks for several popular antivirus tools, and if it detects them, will simply stop running. If there’s nothing in the way one version will install “LaunchAgent,” described as a “persistent infection,” while another will install either “Advanced Mac Cleaner” or a Safari extension.

Joshua Long for Intego:

The team at Intego has observed OSX/CrescentCore in the wild being distributed via numerous sites. Mac users should beware that they may encounter it, even via seemingly innocuous sources such as Google search results.

The new malware was first observed linked from a site purporting to share digital copies of new comic books for free—one of many shady sites that flagrantly violates U.S. copyright laws.

Potentially harmful download links are commonly found on digital piracy sites that claim to offer download links for cracked copies of software, popular movies, and other copyrighted content that cannot be legally obtained for free. It is quite common for links on such sites to send users to malware, scams, or both.

MacDailyNews Take: Don’t steal software.

Here’s our usual oft-repeated reminder for Mac users and anyone who’s trying to use any other platform: Do not download and authorize the installation of applications (Trojans) from untrusted sources. No OS can protect users from themselves (or we wouldn’t be able to install any software). Those who grant attackers access to their Macs, should not be surprised to find their Macs are compromised.

8 Comments

    1. “Dubbed “CrescentCore,” the malware comes as it usually does —in the form of a DMG file pretending to be an Adobe Flash Player installer, Intego said. If someone launches its contents,”
      Macs don’t “get” viruses. Most computers nowadays don’t “get” them. Viruses are “offered” to computers by their idiot users. Any “virus” definition that starts “if you can get them to download and then run and THEN get them to turn off Gatekeeper…” is not really a virus definition. It is a hapless user definition. And that users computer will never be free of viruses even if you disconnect it from the internet LOL

      Because, they will find that USB stick in the parking lot and plug it into their computer knowing they’re going to find pornography or secret agent plans!

    2. Feather, I do not recall anyone on this forum claiming that Macs were immune to viruses and other malware. We are not that stupid. Any computer can be compromised given sufficient access, newly discovered security holes, or user idiocy.

      What we can claim with copious evidence to back it up is that Windows infections are orders of magnitude more common than Mac infections. Furthermore, Mac security risks almost always require one of two vectors: (1) User explicitly authorizing the installation of the suspect software by entering an admin password, or (2) Hacker with hands-on access to your Mac.

      I have owned a couple of Windows PCs in the past. They picked up crap every time that they were powered up. I “protected” those Windows PCs with anti-virus software and scrubbed those Windows PCs at least once a week and I always found new malware – and that was just from being connected to the internet, not from installing new software. I spent way too many hours trying to protect my Windows PCs, and it was hopeless.

      The situation may have improved a lot with the more recent versions of Windows. But I wouldn’t know because my 12-year-old iMac is still plugging away malware free, and Apple clearly cares more about consumer data privacy than any other consumer electronics/media company. Why would I ever switch?

Reader Feedback

This site uses Akismet to reduce spam. Learn how your comment data is processed.