We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

New Mac malware variant surfaces, poses as PDF

Mac malware, while not nearly as widespread as the Windows variety, does occasionally appear. Earlier this year we had Mac Defender. Now security research firm F-Secure has announced the discovery of another up-and-coming Trojan horse.

When downloaded, the Trojan-Dropper:OSX/Revir.A puts what appears to be a multi-page Chinese PDF--containing potentially-volatile political opinions--up on your screen. That's just a bit of misdirection, though: if you open the supposed PDF, the Trojan horse installs Backdoor:OSX/Imuler.A. As the name implies, that component opens up a backdoor connection to a remote server.

For now, that's all the Trojan horse does: The server that it connects to is a bare Apache installation that can't do anything to your Mac. In addition, since the strain was discovered via scanning service VirusTotal rather than direct user reports, F-Secure researchers aren't even sure how the Trojan horse is propagating, though their blog post postulates that email attachments are the most likely vector.

As with other bits of Mac malware, the real worry is that this is proof of a concept, a demonstration of what can be done by malware posing as a legitimate file. While alarming, the PDF ruse is nothing new: Windows PCs have endured many ".pdf.exe" extension trojans over the years. If file extensions are hidden, a fake PDF icon could potentially lure unware users into opening something they shouldn't. As Mac security expert Rich Mogull puts it, "It is a lot easier to fool users into installing something than it is to crack the security of the operating system."

So even though Trojan-Dropper:OSX/Revir.A may not pose an immediate danger, it is a reminder that you should stay alert and take sensible precautions in case it--or something like it--morphs into a real threat. We've written in the past about not clicking on links or downloading attachments in email messages from people you don't know, and about unchecking Safari's Open 'Safe' Files After Downloading option (Safari -> Preferences -> General); as long as you practice common sense, you should be safe from most malicious attacks. You should also be sure to keep your OS X malware definitions up to date.

If you do accidentally fall prey to this particular Trojan horse, F-Secure has put up manual instructions for removing the backdoor. To do so, you'll want to open Activity Monitor; select checkvir and click Quit Process; then delete the following files:

/users/user/Library/LaunchAgents/checkvir /users/user/Library/LaunchAgents/checkvir.plist


IDG UK Sites

How to watch the Windows 9 launch event: no live video stream so catch our Windows 9 launch live...

IDG UK Sites

Windows 9 and the death of the OS as a must-have product

IDG UK Sites

Video trends: 4K is here โ€“ HDR video, VR and 3D audio is coming

IDG UK Sites

Best iPhone 6, iPhone 6 Plus deals: iPhone 6, iPhone 6 Plus tariffs, contracts and prices UK