Earlier this year, researchers from security firm Malwarebytes discovered a piece of Mac malware called Fruitfly that reportedly spied on computers in medical research centers for years before being detected. Apple has since updated macOS to automatically detect the malware, safeguarding users.

macbook air
However, a new variant of the Fruitfly malware has recently been discovered by Patrick Wardle, a researcher with security firm Synack. Wardle said the malware has been targeting Macs for at least five years, with the number of infected Macs totaling nearly 400 and possibly much higher, reports Ars Technica.

The malware can supposedly capture screenshots, keystrokes, webcam images, and other info about each infected Mac. The Fruitfly variant also collects information about devices connected to the same network, according to the report.

Wardle said the method of infection remains unknown, but he suspects it involves tricking users into clicking on malicious links, as opposed to exploiting vulnerabilities in apps or in macOS. He added that the primary command-and-control server used by the malware's creators has since been shut down.

Many of the affected Macs have never been disinfected, however, allowing Wardle to create his own custom command-and-control server for the malware and witness the close to 400 infected machines connect to it.

After analyzing the new variant, Wardle was able to decrypt several backup domains that were hardcoded into the malware. To his surprise, the domains remained available. Within two days of registering one of the addresses, close to 400 infected Macs connected to the server, mostly from homes located in the United States. Although Wardle did nothing more than observe the IP address and user names of Macs that connected to his server, he had the ability to use the malware to spy on the users who were unwittingly infected.

Wardle will provide a briefing about his custom command-and-control server tactics on Wednesday at the Black Hat security conference in Las Vegas.

Since the method of infection is unknown, there aren't many specific steps users can take to ensure they're protected. But, given all domains known to be associated with the malware are no longer available, and the limited number of Macs infected beforehand, most users shouldn't be too worried about this malware.

One option Mac users have is to install OverSight, a free software tool that monitors a Mac's microphone and webcam, alerting the user when the internal microphone is activated, or whenever a process accesses the webcam.

Wardle has reported all of his findings to law enforcement officials, and the threat is likely neutralized, according to the report.

Tag: malware

Top Rated Comments

Altis Avatar
49 months ago
Keep operating systems up to date. Exploitation of un-patched vulnerabilties by non-governments is exceedingly rare.

If you don't do security updates as they become available you almost deserve what you get.
That's why security updates should be separate from feature updates.

A lot of people deliberately don't update because of adverse changes to the user experience, leaving security vulnerabilities.
Score: 7 Votes (Like | Disagree)
throAU Avatar
49 months ago
That's why security updates should be separate from feature updates.

A lot of people deliberately don't update because of adverse changes to the user experience, leaving security vulnerabilities.
I get it, but it comes down to this:

Adapt or switch platforms if the user experience changes bother you that much.

No developer is going to support a massive number of platforms with security updates concurrently. They just can't afford to patch old platforms forever. Because every platform means a seperate codebase to maintain and backport/re-develop updates for, beta test, etc.

Apple right now supports 3 (? more?) OS revisions typically (i.e., they do split feature updates and security updates to that degree already), if you haven't dealt with the "user experience" changes after 2-3 new OS revisions, you should be jumping ship to another platform. Just not patching and becoming insecure isn't really a sensible choice.

I'm guessing the big cries from some still go back to the changes made in Lion. It is well beyond time to get over it.

But you'll get the same thing wherever you jump. MS won't support old operating systems forever, and neither will any Linux distribution. No one will.

Adapt, or deal with being insecure.
Score: 3 Votes (Like | Disagree)
throAU Avatar
49 months ago
Keep operating systems up to date. Exploitation of un-patched vulnerabilties by non-governments is exceedingly rare.

If you don't do security updates as they become available you almost deserve what you get.
Score: 3 Votes (Like | Disagree)
OldSchoolMacGuy Avatar
49 months ago
People aren't aware of this? Been around for years.
Score: 2 Votes (Like | Disagree)
convergent Avatar
49 months ago
I wonder how many windows pcs are infected right now?
I would place my guess at zero Windows PCs infected with malware targeting Mac webcams, but I could be wrong. :rolleyes:
Score: 1 Votes (Like | Disagree)
charlituna Avatar
49 months ago
That's why security updates should be separate from feature updates.

A lot of people deliberately don't update because of adverse changes to the user experience, leaving security vulnerabilities.
with Mac OS they often are
Score: 1 Votes (Like | Disagree)

Top Stories

apple watch ecg

Apple Watch Likely to Gain Blood Pressure, Blood Glucose, and Blood Alcohol Monitoring

Monday May 3, 2021 4:03 am PDT by
The Apple Watch may gain the ability to measure blood pressure, blood glucose, and blood alcohol levels, according to newly-revealed information about one of Apple's chosen business partners. Apple has been revealed to be the largest customer of the British electronics start-up Rockley Photonics, The Telegraph reports. Rockley Photonics has developed non-invasive optical sensors for...
tile sticker e1570533758981

Tile CEO: 'We Welcome Competition From Apple, But We Think It Needs to Be Fair'

Tuesday May 4, 2021 9:51 am PDT by
Just after Apple announced its AirTags, Tile CEO CJ Prober relayed his concerns about competing with Apple in the tracking space, and said that Tile would ask Congress to investigate Apple's business practices specific to Find My and item trackers. Prober this week did an interview with Bloomberg, where he further expanded on Tile's complaints about Apple and why he feels that Tile is...
facebook instargram updated att prompt 1

Facebook and Instagram Ask Users to Enable App Tracking in Order to Keep Services 'Free of Charge'

Sunday May 2, 2021 1:22 pm PDT by
As a way to convince users to enable tracking across other apps and websites, Facebook is deploying the tactic of telling users that they must enable tracking as part of the App Tracking Transparency framework in iOS 14.5 if they want to help keep Facebook and Instagram "free of charge." App Tracking Transparency or ATT is the newest privacy feature to come to iPhone and iPad devices as part ...
fortnite apple logo 2

Epic CEO Tim Sweeney Admits App Store's 30% Cut Is Similar to Consoles, Would Have Accepted Special Deal With Apple

Tuesday May 4, 2021 1:54 pm PDT by
Apple's legal battle with Epic Games is continuing on, and during the second day of the trial, Epic Games' CEO Tim Sweeney continued his testimony against Apple. Sweeney was grilled by Apple's lawyers, and made several points seemingly favorable to Apple. In addition to mentioning how he prefers Apple's iPhone and values Apple's privacy policies that he's aiming to dismantle, Sweeney...
Flat 2021 MacBook Pro Mockup Feature 1

Mini-LED Display Production Improving for Redesigned MacBook Pro Models Later This Year

Monday May 3, 2021 8:33 am PDT by
Apple supplier TSMT, a key vendor involved in the production of mini-LED displays in the newly announced 12.9-inch iPad Pro, has been able to address technical challenges for the production of mini-LED displays to be used in the upcoming 14 and 16-inch redesigned MacBook Pro models. As reported by DigiTimes, TSMT had initially been facing production constraints with the circuit board and...
signal instagram ads3

Signal Shares the Instagram Ads Facebook Doesn't Want You to See

Wednesday May 5, 2021 1:29 am PDT by
Encrypted messaging app Signal has had a series of Instagram ads blocked from the social media platform, after it attempted to show users how much data the Facebook-owned company collects about them and how it's used to push targeted ads. In a blog post, Signal described how it generated the ads to show users why they were seeing them, simply by declaring upfront the information that the...
Foldable iPhone 2023 Feature Yellow

Kuo: Apple to Launch 8-Inch Foldable iPhone in 2023

Sunday May 2, 2021 8:43 pm PDT by
Apple is working to launch a foldable iPhone with an 8-inch QHD+ flexible OLED display in 2023, Apple analyst Ming-Chi Kuo said today in a note to investors that was seen by MacRumors. Based on our latest industry survey, we forecast that Apple will likely launch a foldable iPhone with an 8-inch QHD+ flexible OLED display in 2023, with SDC as the exclusive display supplier and Samsung Foundry...
iOS 14 on iPhone feature emergency

Apple Releases iOS and iPadOS 14.5.1 With Fixes for App Tracking Transparency Bug, WebKit Security Issues

Monday May 3, 2021 10:04 am PDT by
Apple today released iOS and iPadOS 14.5.1, minor security updates that come just a week after the release of the iOS 14.5 update. There is also a companion watchOS 7.4.1 update for Apple Watch and an iOS 12.5.3 update for older iPhone and iPad devices that don't support Apple's latest operating system versions. According to Apple's release notes, the update fixes a bug with App Tracking...
airtags teardown tile mat galaxy smarttag

iFixit Shares AirTag Teardown Revealing 'Impressively Compact' Design Compared to Tile Mate and Galaxy SmartTag

Sunday May 2, 2021 4:54 am PDT by
iFixit has shared the first of its two-part series in tearing down Apple's AirTag item tracker, revealing that Apple had to make impressive design decisions to achieve its small design, including rethinking the speaker layout. For comparison, iFixit compared Apple's AirTag to the Tile Mate and the Samsung Galaxy SmartTag. Compared to the competition, AirTag is the smallest in size, with the...
maxresdefault

Hands-On With Brydge's 12.9-Inch iPad Pro Keyboard With Trackpad

Tuesday May 4, 2021 11:48 am PDT by
Brydge has been making keyboards for Apple's iPads for years now, and the newest model, the Brydge 12.9 MAX+, is compatible with the third, fourth, and fifth-generation iPad Pro models, so it works even with the new mini-LED iPad Pro. Subscribe to the MacRumors YouTube channel for more videos. In our latest YouTube video, we checked out the new Brydge 12.9 MAX+ to see if it's a viable...