Two new pieces of malicious software aimed at Mac computers have been discovered on the Dark Web, offered through Malware-as-a-Service (MaaS) and Ransomware-as-a-Service (RaaS) portals and estimated to have been up for around the past three weeks, beginning May 25. Originally spotted by Bleeping Computer, the two portals offer software called "MacSpy" and "MacRansom" as services for potential buyers, as well as any future support that may be needed for the malware (via Motherboard).

Both portals are the work of the same malware developer, but security firms Fortinet and AlienVault described the person behind the scheme as an "inexperienced coder," pointing towards issues like the lack of digitally signed files, meaning the security measures on a standard installation of macOS would still be alerted to the malware. The researchers called MacSpy the "better-coded tool," but said MacRansom was more dangerous since it "has the potential to permanently wreck user files," if users of malicious intent ever wielded it.

macspy malware

Thankfully, the process by which crooks would have to go about getting either MacSpy or MacRansom will likely prevent either piece of malware from spreading. Both portals are described as "closed" offerings, meaning anyone wanting to actually purchase the services off the Dark Web would have to contact the author to receive demo packages, and then directly negotiate payment. As such, "none of these two appear to be part of any active distribution campaigns."

All the same, as Mac-focused security researcher Patrick Wardle told Motherboard, the increasing intent of cyber criminals to infect Apple's computers is "kind of a milestone." Security reporter Ruben Dodge said that macOS and iOS have so many "less technical people" using the software that it's simply too "ripe" of a target for criminals not to take notice. Although MacRansom and MacSpy aren't expected to take off in that way, Dodge said "it's only a matter of time" before another piece of malware or ransomware does.

Ruben Dodge: "There's an ideological shift for Mac and iPhone as being seen as the more friendly OS for older people. [...] It is a market that will be targeted. There are too many less technical people using it not to make it a 'ripe' target for threat actors."

Patrick Wardle: "Apple continues to improve the security of them," Wardle said. "But Mac users should just be cautions, should not be not be overconfident, and should not assume that just because they're using a Mac they're inherently safe."

Malware attacks on Mac computers were up 744 percent in 2016, although that percentage was largely weighted due to adware bundling in software on MacBooks and iMacs, which is far less alarming than any potential wide-scale malware purchased by a criminal on the Dark Web. Still, Bleeping Computer pointed out in its report that Mac ransomware in particular -- which holds user data ransom until a fee is paid -- has been steadily growing over the past year.

The number of Macs has grown, and so has the number of Mac-targeting malware. The launch of MaaS portals, even if hard to use and engage with as MacSpy and MacRansom, will drive more crooks towards the Mac userbase, and will lower the entry bar for some individuals and groups that had no previous experience with creating Mac malware.

As a rule of thumb, in order to stay safe users should only download apps and programs from Apple's own Mac App Store, and if an app is available only on a third-party website the developer behind the software should be trusted. Although Apple has long advertised the Mac as a truly anti-virus and anti-malware machine, Wardle reminds Apple fans to remain vigilant online: "Mac users...should not be overconfident, and should not assume that just because they're using a Mac they're inherently safe."

Tag: Malware

Top Rated Comments

ignatius345 Avatar
104 months ago
As a rule of thumb, in order to stay safe users should only download apps and programs from Apple's own Mac App Store, and if an app is available only on a third-party website the developer behind the software should be trusted.
Nope. I check every Mac app I buy to see if it's available directly from the developer so they take 100% of the profits. Let's not use malware as an excuse to make sure the Mac is a walled ecosystem like iOS.
Score: 18 Votes (Like | Disagree)
batchtaster Avatar
104 months ago
I’ve seen it here before. Seen it most commonly on the official Apple forums though I must admit. When a new Mac virus pops up, an apologist comes along and says, "No actually it’s a Trojan Horse”. There is a difference of course I know that, but I also know it isn’t the point being made.
Well, it exactly is. If you can't get your terminology right, someone is going to correct you.
You could avoid that annoyance by not being wrong and not sounding like you don't know what you're talking about.
Score: 15 Votes (Like | Disagree)
batchtaster Avatar
104 months ago
Never, all they’ll tell you is that this is a worm and Macs still don’t get viruses. Or similar.
You seem to be under the misconception that there is no difference. That the mechanisms, vectors and payloads are indistinguishable or irrelevant.
There very much is, to the extent that the very people who research and combat these things coined the terms.
If you have a problem with the correct use of the terminology - as opposed to deliberately misusing it for sensationalism sake - then perhaps take it up with them.
Score: 7 Votes (Like | Disagree)
Fall Under Cerulean Kites Avatar
104 months ago
A piece of trojan software that can destroy files, but that is unsigned and requires manual intervention in order to not just install, but run, is not something I’m going to get excited about.
Score: 5 Votes (Like | Disagree)
iDento Avatar
104 months ago
Dear Apple,

I'd happily get all my apps from the MacAppStore when you give a damn, like how you redesigned the iOS AppStore for instance.
Score: 3 Votes (Like | Disagree)
xflashx Avatar
104 months ago
They should finally redesign and rewrite the AppStore completely and change their policies in a way so that developers are more attracted to it. Apps like VLC, texmaker, mactex, Chrome etc. should be present.

Right now the AppStore feels kind of abandoned.
Score: 2 Votes (Like | Disagree)

Popular Stories

Apple CarPlay Ultra instrument cluster themes 01

Apple's 'CarPlay Ultra' Experience Now Available

Thursday May 15, 2025 5:07 am PDT by
Apple today announced that its next-generation CarPlay experience, now dubbed "CarPlay Ultra" begins rolling out today, starting with Aston Martin vehicles. Subscribe to the MacRumors YouTube channel for more videos. CarPlay Ultra is now available with new Aston Martin vehicle orders in the U.S. and Canada. It will also be available for existing models that feature the brand's next-generation ...
Apple CarPlay Ultra instrument cluster themes 01

Apple's CarPlay Ultra Is Here – Does Your iPhone Support It?

Thursday May 15, 2025 5:17 am PDT by
Apple's recently announced CarPlay Ultra promises a deeply integrated in-car experience, but not all iPhone users will be able to take advantage of the new feature. According to Apple's press release, CarPlay Ultra requires an iPhone 12 or later running iOS 18.5 or later. This means if you're using an iPhone 11, iPhone XR, or any older model, you'll need to upgrade your device to access...
CarPlay Ultra Climate Controls

Apple Says These Vehicle Brands Plan to Offer All-New CarPlay Ultra

Thursday May 15, 2025 8:13 am PDT by
Apple today announced the launch of CarPlay Ultra, the long-awaited next-generation version of its CarPlay software system for vehicles. CarPlay Ultra features deep integration with a vehicle's instrument cluster and systems, built-in Radio and Climate apps, customizable widgets, and more. The interface is tailored to each vehicle model and automaker's identity, and drivers can also adjust...
iPhone 12 Made in India

Trump Tells Tim Cook to Stop Building iPhones in India

Thursday May 15, 2025 2:21 am PDT by
President Donald Trump has asked Apple CEO Tim Cook to halt the company's manufacturing expansion in India, in a potential disruption of Apple's plan to shift iPhone production away from China. "I had a little problem with Tim Cook yesterday," Trump said during his state visit to Qatar, according to Bloomberg. "He is building all over India." "They [India] have offered us a deal where...
apple music

Apple Music Gets New Transfer Tool to Make Switching From Spotify Easier

Wednesday May 14, 2025 5:17 pm PDT by
Apple this week introduced a new feature designed to allow prospective Apple Music users to import their saved music and playlists from third-party music services to Apple Music. The feature is either in an expanded testing phase or it has started rolling out, and it is available in Australia and New Zealand according to an Apple Support document. Signs of the transfer option first surfaced...
maxresdefault

Here's the First Real-World Look at Apple's CarPlay Ultra

Thursday May 15, 2025 5:52 am PDT by
The first videos of Apple's CarPlay Ultra experience are now available, providing a never-before-seen look at the long-anticipated iPhone-linked infotainment software. British automaker Aston Martin today shared the first video of Apple's CarPlay Ultra experience in-action, followed by a detailed walk-through of the CarPlay Ultra system on Top Gear's YouTube channel, which provides the...
iOS 18

Apple Releases iOS 18.5 With New Wallpaper, Screen Time Changes, Carrier Satellite Support for iPhone 13 and More

Monday May 12, 2025 10:06 am PDT by
Apple today released iOS 18.5 and iPadOS 18.5, the fifth updates to the iOS 18 and iPadOS 18 operating systems that came out last September. iOS 18.5 and iPadOS 18.5 come a little over a month after Apple released iOS 18.4 and iPadOS 18.4. The new software can be downloaded on eligible iPhones and iPads over-the-air by going to Settings > General > Software Update. The iOS 18.5 update has a...
fortnite apple logo 2

Epic Resubmits Fortnite to U.S. App Store After Not Hearing From Apple for 120+ Hours

Wednesday May 14, 2025 1:01 pm PDT by
On Friday, Epic Games submitted Fortnite to the U.S. App Store, and since then, we've been waiting to see if Apple would approve the game and allow it back on the iPhone and the iPad. There's been no word from Apple so far, but Epic Games opted to pull its first App Store review request, and has now resubmitted Fortnite. Fortnite leaker Shiina shared the news, with the information reposted by...