Malware analysts often examine malware inside a VM to avoid unintentionally infecting their own computers while working with dangerous files, so malware authors sometimes implement VM detection and behave differently to make it more difficult to analyze the malwares behavior.

Osx Player Software Known As

Depending on the variant, the Trojan installer may install rogue software known as Advanced Mac Cleaner ( OSXAMC ) or install a malicious Safari browser extension.

It is quite common for links on such sites to send users to malware, scams, or both.

Nearly all sites have stopped relying on Flash, as Adobe is discontinuing it; the company plans to no longer release security updates for Flash after 2020.

Of course, the majority of casual Internet users arent aware of these facts, and malware makers love to prey on users lack of awareness.

Osx Player Code To Conceal

One page in the redirection chain was caught using obfuscated JavaScript code to conceal the fact that it was a redirector script.

After you scan your Mac, your best bet to prevent future infections is to get VirusBarrier X9, which includes real-time scanning functionalitya critical feature to block malware before it can harm your Mac.

As we learned with OSXLinker, makers of Mac malware are also experimenting with new ways of bypassing Apples built-in protection mechanisms, even attempting to use zero-day vulnerabilities to do so.

Within the past month alone, there have been several new Mac malware campaigns aside from Integos discoveries of OSXCrescentCore and OSXLinker, including OSXNewTab (which Intego was the first to detect), OSXNetwire and OSXMokes (backdoors that spread via a Firefox zero-day vulnerability), OSXLoudMiner aka OSXBirdMiner (cryptocurrency miners that try to evade detection by running inside a virtualized operating system).

Mac users, therefore, would be wise to take steps to actively protect themselves from malware threats.

So far, Intego has specifically observed Sanela Lovic (5UA7HW48Y7) and Sanela Lovic (D4AYX8GHJS) being used to sign malware found in the wild.

A VirusTotal account is required to access these links.) Both of these Developer IDs have been reported to Apple and will likely be disabled soon, so the developer will likely begin to distribute malware under new Apple Developer IDs which may or may not include the name Sanela Lovic.

This article may be updated as further information becomes available.

Youll also want to subscribe to our e-mail newsletter and keep an eye here on The Mac Security Blog for the latest Apple security and privacy news.

Josh has a masters degree in IT concentrating in Internet Security and has taken doctorate-level coursework in Information Security.

Apple has publicly acknowledged Josh for discovering an Apple ID authentication vulnerability.

Joshs security research has been featured by many fine publications such as CNET, CBS News, ZDNet UK, Lifehacker, CIO, Macworld, The Register, and MacTech Magazine.

Look for more of Joshs articles at security.thejoshmeister.com and follow him on Twitter.

This entry was posted in Malware and tagged OSXAMC.fs, OSXCrescentCore, OSXShlayer.