We’ve moved! You can now read the latest and greatest on Mac adware and malware at Malwarebytes.

First Mac ransomware spotted

Posted on March 7th, 2016 at 6:16 AM EST

On Saturday, Apple quietly added detection of something called “KeRanger” to the XProtect anti-malware definitions in OS X. It was revealed on Sunday by Claud Xiao of Palo Alto Networks that KeRanger is the first real Mac ransomware, and it’s not just theoretical. It’s in the wild.

Read the full story on Malwarebytes Labs.

This post is more than 30 days old and has been locked. No further comments are allowed.

Was Mac OS X really the most vulnerable in 2015?

Posted on January 8th, 2016 at 12:19 PM EST

Much has been said in the security world about the recent release of data on vulnerabilities discovered in 2015. Due to the way this data has been presented, many news outlets have been reporting that Mac OS X was the “most vulnerable” OS in 2015. But was it really?

Read the rest of the story on Malwarebytes Unpacked.


Massive MacKeeper data breach

Posted on December 17th, 2015 at 1:06 PM EST

Kromtech, the developer of MacKeeper, has suffered a major breach that has exposed more than 13 million users’ data.

Chris Vickery, a security researcher who has uncovered a number of similar data breaches in the past, found that a Kromtech database full of sensitive data was accessible over the internet… without any login required.

Read the rest of the story on Malwarebytes Unpacked.


Beware scams in the wake of the App Store slip-up

Posted on November 13th, 2015 at 3:17 PM EST

Mac users began to have problems opening apps downloaded from the App Store Wednesday morning. This caused messages that the apps were damaged and would need to be re-downloaded from the App Store.

It turned out that the problem was an expired cryptographic certificate at Apple, used to verify the legitimacy of these apps. Apple didn’t renew it in time, and when it expired, App Store apps failed.

Read the full story on Malwarebytes Unpacked


Has MacUpdate fallen to the adware plague?

Posted on November 2nd, 2015 at 1:17 PM EST

It seems that MacUpdate, long considered to be one of the only remaining trustworthy download aggregation sites for the Mac, has succumbed to the same plague that has ruined most of the others: adware.

Read the full story on Malwarebytes Unpacked


Is Mac malware on the rise?

Posted on October 29th, 2015 at 3:25 PM EST

Last week, Bit9 + Carbon Black released a paper stating that five times more malware for OS X has appeared in 2015 than during the previous five years combined.

Their findings are interesting, but are not well understood by many Mac users. Some have reacted with disbelief, others with great fear for this dangerous new future.

It turns out that the findings are completely true, but depend entirely on your definition of the word “malware.”

Read the full story on Malwarebytes Unpacked.

1 Comment

Bypassing Apple’s Gatekeeper

Posted on October 8th, 2015 at 5:15 PM EST

Ever since Apple first introduced Gatekeeper, malware creators have been trying to find a way around it.

Many different pieces of malware have done so, but at the Virus Bulletin Conference in Prague, Patrick Wardle, a security researcher at Synack, presented his findings on some new and interesting ways to skirt Apple’s security.

Read the full story on Malwarebytes Unpacked.


XcodeGhost malware infiltrates App Store

Posted on September 21st, 2015 at 2:34 PM EST

Late last week, Claud Xiao, a researcher at Palo Alto Networks, announced the discovery of new malware that he calls XcodeGhost. As the story has developed over the weekend, it turns out that this malware has infected at least 39 known iOS apps as of early this morning, all of which made it into the App Store.

Read the full story on Malwarebytes Unpacked.

This post is more than 30 days old and has been locked. No further comments are allowed.

Genieo installer tricks keychain

Posted on August 31st, 2015 at 12:51 PM EST

Earlier this month, an adware installer was found to be taking advantage of the DYLD_PRINT_TO_FILE vulnerability in OS X.

Now Malwarebytes researcher Adam Thomas, who discovered that issue, has found a newer variant of this installer that’s pulling some new tricks.

Read the full story on Malwarebytes Unpacked.

This post is more than 30 days old and has been locked. No further comments are allowed.

DYLD_PRINT_TO_FILE exploit found in the wild

Posted on August 4th, 2015 at 9:47 AM EST

Adam Thomas, a researcher at Malwarebytes, discovered a new adware installer yesterday that is using the DYLD_PRINT_TO_FILE exploit, discovered last month, to install itself with root privileges.

The full story can be found on Malwarebytes Unpacked.