Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


01:21 PM
Connect Directly

Mac OS X Trojan Attack Changes DNS Settings

Researchers spot new variant of malware that prepares machines for botnet recruitment and other cybercrime uses

A new Trojan attack aimed at Mac OS X machines poses as a media player update but instead changes the Domain Name Service (DNS) settings on the victim's machine.

Researchers at Trend Micro recently spotted the Trojan, which poses as a QuickTime Player update and goes by the fake name "MacCinema Installer," in the wild. It's a new variant of an existing Trojan, but with a twist: "What's interesting is that it's a DNS-changing Trojan" for Mac OS X, says David Perry, global director of education for Trend Micro.

Perry says the malware, which Trend Micro has identified as OSX_JAHLAV.D, is basically a stage one infection, meaning that it's likely more a way for cybercrime brokers to set up infected machines for sale later. "The reason they get DNS control is so that later in the game you can sell these assets to a criminal enterprise," which can then change the DNSes and redirect the infected machines, he says.

"We don't know the ultimate use of the machine ... but it's being set up to sell later."

The good news is that the attack doesn't really do any major damage -- yet -- and it's fairly simple to clean it up. Trend suggests dragging and dropping "MacCinema" in the Mac trash box and then changing your machine's DNS settings to "auto."

"This version just changes your DNS. That's just stage one," says Jamz Yaneza, threat research manager for Trend Micro. But the machine is basically set to be automatically updated by the bad guys, although this version of the Trojan doesn't do so at this time, he says.

While the conventional wisdom is that Macs don't get viruses, this attack shows they aren't immune from attack, says. "That might be true [that Macs don't get viruses], but they get Trojans and everything else," he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Firms Improve Threat Detection but Face Increasingly Disruptive Attacks
Robert Lemos, Contributing Writer,  2/20/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-02-22
The F-Secure AV parsing engine before 2020-02-05 allows virus-detection bypass via crafted Compression Method data in a GZIP archive. This affects versions before 17.0.605.474 (on Linux) of Cloud Protection For Salesforce, Email and Server Security, and Internet GateKeeper.
PUBLISHED: 2020-02-22
SOPlanning 1.45 allows XSS via the "Your SoPlanning url" field.
PUBLISHED: 2020-02-22
SOPlanning 1.45 allows XSS via the Name or Comment to status.php.
PUBLISHED: 2020-02-22
fauzantrif eLection 2.0 has SQL Injection via the admin/ajax/op_kandidat.php id parameter.
PUBLISHED: 2020-02-22
CandidATS 2.1.0 is vulnerable to CSRF that allows for an administrator account to be added via the index.php?m=settings&a=addUser URI.