Fake installer trojan targets Mac users
Published December 13th, 2012 at 12:38 PM EST , modified December 13th, 2012 at 12:38 PM EST
Dr. Web announced the discovery of a new Mac trojan, which they call SMSSend, on Tuesday. This latest trojan masquerades as an installer for the legitimate VKMusic application. Rather than install malicious software on your computer, however, the malicious installer requests a cell phone number in order to complete the install process. Users who provide a cell phone number, and then enter the activation code that is texted to that phone, will be subscribed to a “service” that applies charges their cell phone account.
In all, this particular installer’s distribution isn’t likely to be particularly wide. However, the same installer could easily be used to wrap other software in the future, leading to greater prevalence. Users should be sure to download software only from the developer’s site. Avoid downloading software via torrents or other third-party sites not associated with the software.
It should also be noted that texting/cell phone scams that involve charging your account have been around for some time, and are not likely to go away any time soon. You should be cautious with your cell phone, and should never respond to mysterious text messages from unknown parties, nor should you provide your cell phone number to anyone online without a very good reason. (Even then, you should only provide a number to a company that you have reason to trust.) It is especially important to monitor your phone bill if you have children with cell phones, as they cannot be expected to have the same level of judgement that you would.
At this point, few anti-virus programs recognize this malware. Dr. Web does, and ClamXav should recognize it today. Apple has also released an update for their XProtect definitions, so after today, opening this installer on a properly-updated Mac should result in being warned that it is malware… provided that it is not downloaded in a way that bypasses XProtect, such as through a torrent app.