The Newly Discovered Mac Malware OSX.ZuRu and Third-Party Anti-Malware Apps

Started 1 month ago | Discussions thread
ForumParentFirstPrevious
Flat view
lightandaprayer Veteran Member • Posts: 4,654
The Newly Discovered Mac Malware OSX.ZuRu and Third-Party Anti-Malware Apps
3

A recent post on Patrick Wardle's blog entitled Made in China: OSX.ZuRuis about the discovery of Mac malware that steals various things including the infected system's keychain.

The malware is installed via links on a website that pretends to host the popular Terminal emulator iTerm2 . This link is the Real Deal; the bogus malicious website replaces .com in the bona fide URL with .net. (I tried connecting to the imposter website but DNS resolving is unsuccessful; the website has been offline since September 15.)

This is a good lesson why it is worth registering variations of a .com domain name, especially .net and .org if they are available. I don't enjoy spending the extra dough but I make a habit of doing it with my important domains. It's easy to configure the additional domains so visitors wind up at your primary active website if they input another related URL by mistake.

Patrick goes into a lot of detail about how the malware works and what it does once it is installed on a Mac. At the time the article was posted September 14, neither the installer disk image nor an enclosed dylib was flagged by any of the anti-virus engines on VirusTotal as malicious.

Fortunately, Lulu successfully flags and displays alerts for two outbound connection attempts by the malware. That's two warnings that something is amiss and the user should seriously reconsider what they are about to do.

The second alert is for the attempted exfiltration of the pilfered data to a remote server. This is another example why certain third-party anti-malware utilities are very useful additions to the built-in security protections of the Mac OS .  Lulu is the first Objective-See utility I discovered a couple of years ago and it is installed on all of our Macs.

ForumParentFirstPrevious
Flat view
ForumParentFirstPrevious
Keyboard shortcuts:
FForum PPrevious NNext WNext unread UUpvote SSubscribe RReply QQuote BBookmark MMy threads
Color scheme? Blue / Yellow