Got a tip for us? Share it...

New in OS X: Get MacRumors Push Notifications on your Mac

Resubscribe Now Close

Raid on Russian Firm May Have Taken Down MacDefender Malware

MacDefender was the most significant malware attack on the Mac in years, if ever. The threat started in May, infecting many less-savvy Mac users, and had become widespread enough that Apple was forced to release a special anti-malware security fix. The software would be downloaded when users visited certain websites and, once installed, looked to be legitimate anti-virus software. Unsuspecting users would get warnings of viruses infecting their system. By entering their credit card number, users could pay to "remove" the viruses.

Except it was all fake. There were no viruses, just a piece of software trying to trick users into handing over their credit card numbers.


The hidden developer behind MacDefender continued to release new variants of the malware into the wild, resulting in a cat-and-mouse game as Apple continued to ban new variants of the software.

Then, one day, MacDefender simply disappeared. Richard Gaywood, at TUAW, pointed out that Apple hadn't updated its malware definitions -- the code designed to kill MacDefender -- since June 18.

Brian Krebs might have the answer:
On June 23, Russian police arrested Pavel Vrublevsky, the co-founder of Russian online payment giant ChronoPay and a major player in the fake AV market.

[...]

In May, I wrote about evidence showing that ChronoPay employees were involved in pushing MacDefender — fake AV software targeting Mac users. ChronoPay later issued a statement denying it had any involvement in the MacDefender scourge.

But last week, Russian cops who raided ChronoPay’s offices in Moscow found otherwise. According to a source who was involved in the raid, police found mountains of evidence that ChronoPay employees were running technical and customer support for a variety of fake AV programs, including MacDefender.
The last release of MacDefender occurred on June 18. ChronoPay's offices are raided June 23. A coincidence perhaps, or Russian law enforcement saving Mac users from fake antivirus software.

Top Rated Comments

(View all)

39 months ago



Maybe I'm being too harsh, but anyone that falls for the old "YOU HAVE VIRUSES!!! Give us your credit card number and we'll get rid of them!" trick deserves what they get.


Yeah, you are absolutely being too harsh.

Just because you are a bit trustworthy and/or naive - or just very new to the world of computers - does not mean you "deserve what you get".
Rating: 15 Votes
39 months ago



In Soviet Russia, anti-virus software....

No, I'm not gonna go there...


In Soviet Russia, malware...oh screw it, I'm just happy to see them arrested.


I'll do it for you two


In Soviet Russia, anti-virus software infects you!
Rating: 15 Votes
39 months ago

Thank god Vladimir Poutine was infected unless this would have never happened :p


Now I'm hungry...

Poutine: http://en.wikipedia.org/wiki/Poutine
Putin: http://en.wikipedia.org/wiki/Vladimir_Putin
Rating: 12 Votes
39 months ago
It was Apple's screte service i tell you :D
Rating: 11 Votes
39 months ago

THROW AWAY THE KEY... or shoot them.


Siberia baby!
Rating: 10 Votes
39 months ago
THROW AWAY THE KEY... or shoot them.
Rating: 9 Votes
39 months ago
Thank god Vladimir Poutine was infected unless this would have never happened :p
Rating: 9 Votes
39 months ago

So now we're back down to 2.


Yep, 2 neg ratings for that. LOL

I love your neg ratings guys. I feed off your tears, sense of entitlement, and utter frustration that OS X somehow, miraculously, after nearly a decade, still has fewer threats against it than you've got fingers on your one hand (yeah, the one you type with on your $400 hackintosh.) The nerd-rage against Apple is beautiful. Keep em coming.

Yeah, it really sucks that there are like no threats for OS X. Gotta be a negative.
Rating: 7 Votes
39 months ago



Maybe I'm being too harsh, but anyone that falls for the old "YOU HAVE VIRUSES!!! Give us your credit card number and we'll get rid of them!" trick deserves what they get.


Try to remember back when you were a newbie and not the techno-sophistic you are now. There is a learning curve. People come to sites like MR so they can learn (and not be duped by malware).

A tiny bit of empathy might be in order. :rolleyes:
Rating: 7 Votes
39 months ago
If this is the worst "threat" Mac users see then I find that pretty funny ;). I mean it doesn't do anything. Well, other than some small pop ups and asks for your credit card? Really? That is considered a "major threat..." :)

Unless it slows down or crashes your computer (ahem Windows Super Antivirus 2009 (10, 11, etc) then its just annoying. Nice that its gone though :D

My dad actually managed to get this thing [facepalm]. I just deleted it from apps and presto. Gone. It didn't even leave anything on the system (did a full search). =). Alternatively removing the fake A/V software on Windows can be a bit of a chore and best if you catch it early.
Rating: 7 Votes

[ Read All Comments ]