{"id":56704,"date":"2016-09-09T09:45:46","date_gmt":"2016-09-09T16:45:46","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=56704"},"modified":"2016-09-12T11:02:17","modified_gmt":"2016-09-12T18:02:17","slug":"uptick-in-malware-and-vulnerabilities-what-you-need-to-know","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/uptick-in-malware-and-vulnerabilities-what-you-need-to-know\/","title":{"rendered":"Uptick in Malware and Vulnerabilities: What You Need to Know"},"content":{"rendered":"

\"Mac<\/p>\n

Intego has seen a\u00a0recent\u00a0increase in malware that affects Apple products, and while these threats are currently low risk, there are few things you need to be aware of so you can stay protected.<\/p>\n

The recent\u00a0uptick in malware began over the summer\u00a0with the discovery of Eleanor<\/a>, a piece of malware that opens a backdoor on OS X masquerading as a file converter app. Less than\u00a0a month later followed\u00a0the discovery of Adwind RAT<\/a>, a remote access trojan targeting OS X.<\/p>\n

That same month, we learned of the Pegasus exploit affecting iOS<\/a>, giving those who targeted and infected an iOS device full access over its contents; Apple patched the same flaws in OS X<\/a> about a week later. Though no in the wild exploit like Pegasus is known to target OS X, it is not a stretch to think it may have been out there.<\/p>\n

August was a busy month as the Keydnap malware was found<\/a> to hitch a ride on the Transmission application, stealing the OS X keychain contents from those infected.<\/p>\n

That\u2019s just the kind of trouble that was out there for OS X and iOS users in the last two months. Luckily, Apple patched the vulnerabilities that allowed Pegasus to run and Intego protects its customers\u00a0from the above mentioned malware.<\/p>\n

While there currently appears to be no active malware out there that can pose a threat, Intego is following several potential threats. Following are a few of these potential threats that Mac users need to be aware of.<\/p>\n

Potential new Adwind RAT<\/strong><\/h3>\n

Early September we learned of a file being distributed through email that, when opened, opens a backdoor on an OS X system and keeps an active connection to a remote server. It also creates a LaunchAgent to keep itself alive if a user logs out or restarts the computer. The process that runs in the background identifies itself as \u201cStreamMainer,\u201d which is a name that has been linked to Adwind in the past.
\n\"Adware-RAT-StreamMainer-Process\"<\/a>
\nTraffic that was monitored between the backdoor and the server showed a certificate by \u201cassylias.Inc,\u201d which was also an indication this may be a version of Adwind.
\n\"Adware-RAT-pcap-grab\"<\/a>
\nInstalling<\/strong><\/p>\n

When the malicious file is opened, Java installs files in the following locations:<\/p>\n