Security firm Intego announced Monday that a fake antivirus program for Mac OS X has been discovered in the wild. While the threat potential remains low, inexperienced users could be fooled into paying to remove fake viruses “detected” by the software, and in the process, could end up giving credit card information to scammers.
The fake antivirus software calls itself “MAC Defender,” perhaps the first hint that it should not be trusted (Apple makes “Macs,” not “MACs”). Those behind the malware used SEO poisoning to make links to the software show up at the top of search results in Google and other search engines. Clicking the links that show up in search results brings up a fake Windows screen that tells the user a virus has been “detected,” another clue that something is fishy. JavaScript code then automatically downloads a zipped installer for MAC Defender.
If the “Open ‘safe’ files after downloading” option is turned on in Safari, the installer will be unzipped and run. Since the installer requires a user password, it won’t install without user interaction. However, inexperienced users may be fooled into thinking the software is legitimate.
Intego notes that the application is well designed and doesn’t have misspellings or other errors common to such malware on Windows. The software will periodically display Growl alerts that various fake malware has been detected, and also periodically opens porn websites in the default browser, perhaps leading a user to believe the detected malware “threats” are real. Users are then directed to an insecure website to pay for a license and “clean” the malware infections. However, the buying the license merely stops the fake alerts from popping up, but your money and credit card info is now in the hands of hackers.
While MAC Defender wouldn’t likely fool an experienced user, Intego notes that its appearance in the wild is yet another opportunity to detail some useful security precautions. Don’t let your browser automatically open downloads. If your browser asks if you want to run an installer even though you didn’t try to download one, click “cancel.” And never give your password to run installers you aren’t 100 percent sure about.
Read the comments on this post
See original article:
Fake “MAC Defender” antivirus app scams users for money, CC numbers
