Security hole in MacKeeper used to shove malware onto Macs

– Man holding Mac courtesy of Shutterstock –

There isn’t a lot of Mac malware.

Most cybercrooks, we have to assume, are making so much money from infected Windows computers that they haven’t had to worry about supporting other platforms, such as OS X.

But that’s only most, not all cybercrooks.

Mac malware does indeed exist, and it should be no surprise that Mac crooks have a similar MO (modus operandi) to their counterparts in Windows-based cybercrime.

Here are some examples we’ve seen over the years where the Windows malware “playbook” has been followed, in some cases extremely effectively, on OS X:

What now?

Researchers at BAE just reported on a Mac bot known as OSX/Agent-ANTU that was allegedly distributed in a novel way.

The crooks used a security hole in a controversial Mac security and cleanup utility called MacKeeper.

MacKeeper quickly patched the hole after it became known, but until you received the update you were at risk of a Remote Code Execution (RCE) hole.

As long as you were unpatched, a crook could simply entice or redirect you to a poisoned website, and use a single line of JavaScript to send a command script to MacKeeper, which would then run it.

Unfortunately, according to BAE, some crooks struck while the iron was hot.

The crooks sent unpatched MacKeeper users to a web page that tricked their Macs into downloading the OSX/Agent-ANTU malware.

Ironically, the downloader used a fake malware report to justify any MacKeeper popup that might ask you for your administrative password, thus giving the malware system-wide powers.

As in the OSX/LaoShu case mentioned above, the malware included not only a downloader component to let the crooks install what they wanted, but also an upload function handy for stealing files.

What to do?

If you have MacKeeper, and intend to keep on using it, make sure it’s up-to-date.

Of course, if you don’t have MacKeeper, that alone doesn’t make you immune from infection by OSX/Agent-ANTU, or any other Mac malware, for that matter.

Also, don’t assume that Mac malware always needs an administrator prompt before it can do anything harmful.

Consider ransomware, for example: that sort of malware generally leaves your system files and applications well alone, even if it does have administrator access, so that you can still get online easily to pay the unscrambling fee.

But ransomware, while it’s running under your account, can nevertheless scramble all your data files – the ones that really matter!

So, if you haven’t yet crossed the bridge and become a Mac anti-virus user, now would be a good time to give it a go.