New Mac Malware Discovered on Dark Web as Security Experts Remind Mac Users Not to Be 'Overconfident'

by

Two new pieces of malicious software aimed at Mac computers have been discovered on the Dark Web, offered through Malware-as-a-Service (MaaS) and Ransomware-as-a-Service (RaaS) portals and estimated to have been up for around the past three weeks, beginning May 25. Originally spotted by Bleeping Computer, the two portals offer software called "MacSpy" and "MacRansom" as services for potential buyers, as well as any future support that may be needed for the malware (via Motherboard).

Both portals are the work of the same malware developer, but security firms Fortinet and AlienVault described the person behind the scheme as an "inexperienced coder," pointing towards issues like the lack of digitally signed files, meaning the security measures on a standard installation of macOS would still be alerted to the malware. The researchers called MacSpy the "better-coded tool," but said MacRansom was more dangerous since it "has the potential to permanently wreck user files," if users of malicious intent ever wielded it.

macspy malware

Thankfully, the process by which crooks would have to go about getting either MacSpy or MacRansom will likely prevent either piece of malware from spreading. Both portals are described as "closed" offerings, meaning anyone wanting to actually purchase the services off the Dark Web would have to contact the author to receive demo packages, and then directly negotiate payment. As such, "none of these two appear to be part of any active distribution campaigns."

All the same, as Mac-focused security researcher Patrick Wardle told Motherboard, the increasing intent of cyber criminals to infect Apple's computers is "kind of a milestone." Security reporter Ruben Dodge said that macOS and iOS have so many "less technical people" using the software that it's simply too "ripe" of a target for criminals not to take notice. Although MacRansom and MacSpy aren't expected to take off in that way, Dodge said "it's only a matter of time" before another piece of malware or ransomware does.

Ruben Dodge: "There's an ideological shift for Mac and iPhone as being seen as the more friendly OS for older people. [...] It is a market that will be targeted. There are too many less technical people using it not to make it a 'ripe' target for threat actors."

Patrick Wardle: "Apple continues to improve the security of them," Wardle said. "But Mac users should just be cautions, should not be not be overconfident, and should not assume that just because they're using a Mac they're inherently safe."

Malware attacks on Mac computers were up 744 percent in 2016, although that percentage was largely weighted due to adware bundling in software on MacBooks and iMacs, which is far less alarming than any potential wide-scale malware purchased by a criminal on the Dark Web. Still, Bleeping Computer pointed out in its report that Mac ransomware in particular -- which holds user data ransom until a fee is paid -- has been steadily growing over the past year.

The number of Macs has grown, and so has the number of Mac-targeting malware. The launch of MaaS portals, even if hard to use and engage with as MacSpy and MacRansom, will drive more crooks towards the Mac userbase, and will lower the entry bar for some individuals and groups that had no previous experience with creating Mac malware.

As a rule of thumb, in order to stay safe users should only download apps and programs from Apple's own Mac App Store, and if an app is available only on a third-party website the developer behind the software should be trusted. Although Apple has long advertised the Mac as a truly anti-virus and anti-malware machine, Wardle reminds Apple fans to remain vigilant online: "Mac users...should not be overconfident, and should not assume that just because they're using a Mac they're inherently safe."

Tag: malware

Top Rated Comments

ignatius345 Avatar
45 months ago

As a rule of thumb, in order to stay safe users should only download apps and programs from Apple's own Mac App Store, and if an app is available only on a third-party website the developer behind the software should be trusted.

Nope. I check every Mac app I buy to see if it's available directly from the developer so they take 100% of the profits. Let's not use malware as an excuse to make sure the Mac is a walled ecosystem like iOS.
Score: 18 Votes (Like | Disagree)
batchtaster Avatar
45 months ago

I’ve seen it here before. Seen it most commonly on the official Apple forums though I must admit. When a new Mac virus pops up, an apologist comes along and says, "No actually it’s a Trojan Horse”. There is a difference of course I know that, but I also know it isn’t the point being made.

Well, it exactly is. If you can't get your terminology right, someone is going to correct you.
You could avoid that annoyance by not being wrong and not sounding like you don't know what you're talking about.
Score: 15 Votes (Like | Disagree)
batchtaster Avatar
45 months ago

Never, all they’ll tell you is that this is a worm and Macs still don’t get viruses. Or similar.

You seem to be under the misconception that there is no difference. That the mechanisms, vectors and payloads are indistinguishable or irrelevant.
There very much is, to the extent that the very people who research and combat these things coined the terms.
If you have a problem with the correct use of the terminology - as opposed to deliberately misusing it for sensationalism sake - then perhaps take it up with them.
Score: 7 Votes (Like | Disagree)
Fall Under Cerulean Kites Avatar
45 months ago
A piece of trojan software that can destroy files, but that is unsigned and requires manual intervention in order to not just install, but run, is not something I’m going to get excited about.
Score: 5 Votes (Like | Disagree)
iDento Avatar
45 months ago
Dear Apple,

I'd happily get all my apps from the MacAppStore when you give a damn, like how you redesigned the iOS AppStore for instance.
Score: 3 Votes (Like | Disagree)
xflashx Avatar
45 months ago
They should finally redesign and rewrite the AppStore completely and change their policies in a way so that developers are more attracted to it. Apps like VLC, texmaker, mactex, Chrome etc. should be present.

Right now the AppStore feels kind of abandoned.
Score: 2 Votes (Like | Disagree)

Top Stories

m1 chip macbook air pro

Kuo: Redesigned MacBooks With Apple Silicon to Launch in Second Half of 2021

Tuesday November 24, 2020 7:53 pm PST by
Apple plans to release additional MacBook models with Apple Silicon in the second half of 2021, according to analyst Ming-Chi Kuo, as part of the company's two-year transition away from Intel processors across its Mac lineup. In a research note today, obtained by MacRumors, Kuo said that these MacBook models will feature a new design. Kuo did not specify which models these will be, but he...
Apple Watc black friday 20 sale feature

Apple Black Friday 2020: Best Apple Watch Deals [Updated]

Wednesday November 25, 2020 4:01 pm PST by
Black Friday sales have begun on a variety of products, including the Apple Watch. There are quite a few deals across the Apple Watch lineup this year, including one of the lowest price we've ever seen the Apple Watch Series 3. Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make a purchase, we may receive a small payment, which helps us keep the...
AirPods Pro black friday 20 sale feature 2

Black Friday 2020: AirPods Pro Reach Lowest Price Ever [Updated]

Wednesday November 25, 2020 3:22 pm PST by
Black Friday has kicked off this week, and one of the first major sales for the AirPods Pro is available right now on Walmart. You can find this deal below, along with a few other solid discounts on the regular AirPods. Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site...
13 16 inch macbook pro air trio

Reliable Leaker Suggests Redesigned MacBooks in 2021 Will Include Both Apple Silicon and Intel Models

Wednesday November 25, 2020 9:15 am PST by
Reliable leaker known as "L0vetodream" has today suggested on Twitter that redesigned MacBooks coming in the second half of 2021 will include models with both Apple Silicon chips and Intel processors. The brief Tweet came in response to a MacRumors article from earlier today, which outlined a report from Ming-Chi Kuo claiming that Apple plans to release redesigned MacBook models with Apple ...
mac mini macbook pro macbook air

Apple M1 Hands-On Comparison: MacBook Air vs. MacBook Pro vs. Mac Mini

Monday November 23, 2020 3:40 pm PST by
Apple's M1 Macs are out in the wild now, but ahead of the holidays, you might still be trying to figure out which one to pick up, either for yourself or as a gift for someone else. We've got all three of the new Macs available, so we thought we'd give MacRumors readers a hands-on overview of each machine in our latest YouTube video. Subscribe to the MacRumors YouTube channel for more videos. ...
app store christmas icon

Apple Shutting Down App Store Connect From December 23 to December 27

Monday November 23, 2020 10:14 am PST by
Apple shuts down App Store Connect for a week around the holidays each year in an effort to give App Store staff time off from work. This year, App Store Connect will be unavailable from December 23 to December 27. With App Store Connect unavailable, Apple will not accept new apps or app updates, so all pricing changes and new app submissions need to be locked in before those dates for...
iPads black friday 20 sale feature

Apple Black Friday 2020: Best iPad Deals [Updated]

Tuesday November 24, 2020 8:51 am PST by
Black Friday is underway, and we're tracking discounts across Apple's lineup of iPads, including the current-generation 10.2-inch iPad, iPad Air, and iPad Pro. We'll be keeping this post updated as new deals appear and current ones expire, so be sure to keep checking back for the latest. Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make a...
Target November Deals 1

Black Friday Spotlight: Target Begins Week-Long Sale With Deals on iPhone 12, Powerbeats Pro, and More

Monday November 23, 2020 8:07 am PST by
We've been tracking early Black Friday deals in our dedicated Black Friday Roundup, and in an effort to prepare our readers for the big shopping event we're highlighting sales store-by-store in the lead-up to November 27. Note: MacRumors is an affiliate partner with Target. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running....
new mac mini logicpro screen

M1 Macs Able to Run Up to Six External Displays Using DisplayLink

Tuesday November 24, 2020 6:53 am PST by
It is possible to run up to six external displays from the M1 Mac mini, and five external displays from the M1 MacBook Air and MacBook Pro, with the aid of DisplayPort adapters, according to YouTuber Ruslan Tulupov. This far exceeds Apple's specified limits on external displays with the M1 Macs. Apple's host of new M1 Macs are not capable of supporting as many external displays as their...
2020 apple shopping event

Apple Offering Up to $150 Gift Card With Select Products on Black Friday Through Cyber Monday

Monday November 23, 2020 2:53 am PST by
Apple has announced its annual four-day shopping event, offering customers up to a $150 Apple Store gift card with the purchase of select products between Black Friday and Cyber Monday in the United States. The gift card values in the United States are as follows: $150 for 16-inch MacBook Pro $150 for 21.5-inch iMac $50 for 13-inch MacBook Pro $50 for MacBook Air $50 for iPhone SE,...