Researchers from F-Secure, Webroot, and Avast have uncovered Janicab.A, a new trojan that was discovered as a threat to Macs last week and Windows users on Monday, with findings being published recently.

For OS X users, Janicab.A was signed with a valid Apple Developer ID and also uses a special unicode character known as a "right-to-left override" (RLO) that is used in email malware attacks. From there, the trojan uses a YouTube page to hijack infected computers, directs them to command-and-control (C&C) servers, and then leaves the server and hides the infection by making the malware appear as a harmless PDF or DOC file.

janicab_2a_malware
Webroot writes:

After a relatively long lag period without seeing any particular new and exciting Mac malware, last week we saw the surfacing of a new and interesting method of compromising the OSX system. Malware authors have taken a new approach by altering file extensions of malicious .app packages in order to trick users into thinking they are opening relatively harmless .pdf or .doc files. Changing file extensions in Mac OSX can be tricky due to a built in security feature of the OS that detects attempts to change the extension and automatically annexes the extension of its correct file or package type.

This news comes after Apple updated security definitions to combat 'Yontoo', an adware trojan this past March, while also regularly dealing with Java-related vulnerabilities. Apple introduced Gatekeeper in OS X Mountain Lion in order to better deal with security threats, offering a way for users to restrict installation of apps to those signed by Apple-issued Developer IDs.

Top Rated Comments

whooleytoo Avatar
154 months ago
Cross-platform malware? And the Mac version was released first? Yaaaay!
Score: 20 Votes (Like | Disagree)
blackcrayon Avatar
154 months ago
If it's signed with a valid developer ID shouldn't that mean Apple should've already revoked it? Which brings up a question, if Apple revokes a developer ID because of malware, does OS X notify you that was the reason? Or do they just say it's "invalid" (in which case lots of people will still right click and open it :)

(I'm guessing the File Quarantine feature should have this added as well by now)
Score: 12 Votes (Like | Disagree)
Michael Scrip Avatar
154 months ago


But what does it actually do? :confused:

It gets an article on MacRumors

:D
Score: 10 Votes (Like | Disagree)
jeznav Avatar
154 months ago
Not all OSX users have Adobe Acrobat Reader installed. Icon FAIL.

Should've used Preview.app PDF icon instead.
Score: 8 Votes (Like | Disagree)
Parasprite Avatar
154 months ago
Malware authors have taken a new approach by altering file extensions of malicious .app packages in order to trick users into thinking they are opening relatively harmless .pdf or .doc files.

New because of the .app part maybe, but .pdf.exe is not a new approach by any means.

Also, who here uses Adobe for PDFs? (beyond filling out that one form that didn't work right in Preview for some reason)
Score: 3 Votes (Like | Disagree)
antonis Avatar
154 months ago
Still, don't get surprised if people that don't even have the adobe reader installed on their mac will still open a "pdf" that is using the acrobat icon. There are users and users.
Score: 2 Votes (Like | Disagree)

Popular Stories

iOS 18

Apple Releases iOS 18.5 With New Wallpaper, Screen Time Changes, Carrier Satellite Support for iPhone 13 and More

Monday May 12, 2025 10:06 am PDT by
Apple today released iOS 18.5 and iPadOS 18.5, the fifth updates to the iOS 18 and iPadOS 18 operating systems that came out last September. iOS 18.5 and iPadOS 18.5 come a little over a month after Apple released iOS 18.4 and iPadOS 18.4. The new software can be downloaded on eligible iPhones and iPads over-the-air by going to Settings > General > Software Update. The iOS 18.5 update has a...
iPhone 17 Pro Blue Feature Tighter Crop

WSJ: Apple Weighing Price Hikes for iPhone 17 Lineup Without Blaming Tariffs

Monday May 12, 2025 3:36 am PDT by
Apple is considering raising prices for its upcoming iPhone 17 models set to release this fall, according to people familiar with the matter cited by The Wall Street Journal. The company reportedly aims to pair the potential price hikes with new features and design changes to justify the increased cost to consumers, rather than attributing them to U.S. tariffs on goods from China. The...
tvOS 18 Feature

Apple Releases tvOS 18.5

Monday May 12, 2025 10:01 am PDT by
Apple today released tvOS 18.5, the latest version of the tvOS operating system. tvOS 18.5 comes a little over a month after the launch of tvOS 18.4, and it is available for the Apple TV 4K and Apple TV HD models. tvOS 18.5 can be downloaded using the Settings app on the ‌Apple TV‌. Open up Settings and go to System > Software Update to get the new software. ‌Apple TV‌ owners who have...
macOS Sequoia Feature

Apple Releases macOS Sequoia 15.5

Monday May 12, 2025 10:10 am PDT by
Apple today released macOS Sequoia 15.5, the fifth major update to the macOS Sequoia operating system that launched last September. macOS Sequoia 15.5 comes a little over a month after the launch of macOS Sequoia 15.4. Mac users can download the ‌‌‌macOS Sequoia 15.5‌‌‌ update through the Software Update section of System Settings. It is available for free on all Macs able to run ...
iOS 18

iOS 18.5 Expected This Week With These New Features

Monday May 12, 2025 7:20 am PDT by
Following more than a month of beta testing, Apple is expected to release iOS 18.5 to the general public this week. While the software update is relatively minor, it still includes a handful of new features and changes for iPhones. Below, we recap everything new in iOS 18.5. Pride Wallpaper Apple recently announced its 2025 Pride Collection, including a new Apple Watch band, watch face,...
Apple Logo Spotlight Blue

Report: Apple Preparing to Launch Mind-Control Support for iPhones

Tuesday May 13, 2025 6:18 am PDT by
Apple is planning to allow users to natively control iPhones, iPads, and other devices using brain signals later this year, The Wall Street Journal reports. The initiative involves a partnership with Synchron, a neurotechnology startup that produces an implantable brain-computer interface (BCI) device called the Stentrode. The Stentrode enables users with severe motor impairments, such as...