All started with iPhone...:)

Some days ago I had to replace the battery on my wife's iPhone, and after that I noticed that the Wifi was not working properly anymore...so I decided to check on Google for pictures of the iPhone antenna so that I could open again and verify if I left anything loose (which later I found to be the case...) :) .
A regular search for "iphone wifi antenna"  (BE CAREFUL) and I got several hits...and as Google is proactive, it also showed some examples of pictures related to my search.
Well, I decided to see one of the pictures and clicked on it. It then started to load and suddenly was redirected to another page, which looked like my Finder screen:

As you can see, this looks a lot as a common Finder screen. It also looks a LOT like the common FakeAV (FakeAlert) tactics for Windows, where they use JavaScript to simulate a fake scan on "My Computer", showing all drivers and folders being scanned.

That is exactly what happens on the next screenshot:

Note that everything is really well crafted to look real. On Windows systems they use real detection names for the fake trojans found on the system. Here they use detection names to resemble Mac trojan names, which includes the OSX on the name.

 Whenever you press Cancel or Remove All it will push the "anti-malware.zip" file which is actually a .DMG file (the one used by Mac OSX).

At the time of this diary, only 17 of 42 AV detects it on VirusTotal, some as MacDefender, some as Downloader.OSX.

--------------------------------------------------------------
Pedro Bueno (pbueno /%%/ isc. sans. org)
Twitter: http://twitter.com/besecure