Mac OS X Trojan Attack Changes DNS Settings
Researchers spot new variant of malware that prepares machines for botnet recruitment and other cybercrime uses
A new Trojan attack aimed at Mac OS X machines poses as a media player update but instead changes the Domain Name Service (DNS) settings on the victim's machine.
Researchers at Trend Micro recently spotted the Trojan, which poses as a QuickTime Player update and goes by the fake name "MacCinema Installer," in the wild. It's a new variant of an existing Trojan, but with a twist: "What's interesting is that it's a DNS-changing Trojan" for Mac OS X, says David Perry, global director of education for Trend Micro.
Perry says the malware, which Trend Micro has identified as OSX_JAHLAV.D, is basically a stage one infection, meaning that it's likely more a way for cybercrime brokers to set up infected machines for sale later. "The reason they get DNS control is so that later in the game you can sell these assets to a criminal enterprise," which can then change the DNSes and redirect the infected machines, he says.
"We don't know the ultimate use of the machine ... but it's being set up to sell later."
The good news is that the attack doesn't really do any major damage -- yet -- and it's fairly simple to clean it up. Trend suggests dragging and dropping "MacCinema" in the Mac trash box and then changing your machine's DNS settings to "auto."
"This version just changes your DNS. That's just stage one," says Jamz Yaneza, threat research manager for Trend Micro. But the machine is basically set to be automatically updated by the bad guys, although this version of the Trojan doesn't do so at this time, he says.
While the conventional wisdom is that Macs don't get viruses, this attack shows they aren't immune from attack, says. "That might be true [that Macs don't get viruses], but they get Trojans and everything else," he says.
Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.
About the Author(s)
You May Also Like
Beyond Spam Filters and Firewalls: Preventing Business Email Compromises in the Modern Enterprise
April 30, 2024Key Findings from the State of AppSec Report 2024
May 7, 2024Is AI Identifying Threats to Your Network?
May 14, 2024Where and Why Threat Intelligence Makes Sense for Your Enterprise Security Strategy
May 15, 2024Safeguarding Political Campaigns: Defending Against Mass Phishing Attacks
May 16, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024