Threat Level: green Handler on Duty: Johannes Ullrich

SANS ISC: More on MAC OSX Malware - MACDefender Fake Antivirus SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms:

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
More on MAC OSX Malware - MACDefender Fake Antivirus

A new strain of malware going by the name of "MACDefender" is making the rounds - Fake Antivirus in a new disguise!  It's dowloaded as a compressed ZIP containing JavaScript.  In some cases users are directed to download this malware from a specific site, but there are reports that it's also showing up directly in Google Image Searches.

If you have "Open Safe files after downloading" enabled in Safari, downloading this file will auto-install this code.

In it's current incarnation, MACDefender shows up in the installed applications list, so can be uninstalled.  If you have accidentally installed this, go ahead and uninstall it.  I would not expect this "uninstall" option to be a good long term protection strategy.  I'd suggest that OSX users disable "Open safe files after downloading", and also invest in a reasonable anti-malware suite.  Installing a real anti-malware package is also a good idea (no matter what the Apple Fans say ..)

As in all platforms, downloading any code from the internet that suggests anything like "click here and we'll check you for malware" or "you have a virus, click here to clean your machine" or "click here to tune your computer to run faster" is probably a really bad idea.  Almost without exeption, these sites are enticing you to help install malware on your computer, not protect it.

More detail here ==>

Rob VandenBrink


Rob VandenBrink

563 Posts
ISC Handler
May 2nd 2011

Sign Up for Free or Log In to start participating in the conversation!