Feeds

DIY crimekit brings advanced malware to Mac OSX

Next stop: iPad and Linux users

High performance access to file storage

A crimeware kit discovered over the weekend promises to bring a flood of advanced malware that steals passwords and other sensitive data from computers running Mac OS X.

The kit is being advertised as the Weyland-Yutani Bot in underground crime websites, where it's being sold for $1,000. The first ever crimeware kit for the Mac comes with the ability to grab data entered into Firefox, with the Chrome and Safari browsers soon to follow, according to Danish IT firm CSIS Security Group. The makers of the new DIY malware kit claim they are close to releasing versions that will work on iPads and Linux machines as well.

Software compatibility has long been a key selling point in legitimate markets, and it's no different in criminal circles. Weyland-Yutani uses web injection templates that are identical to those offered by the ZeuS and Spyeye crimeware kits available for targeting Windows computers. The forms seamlessly inject fraudulent fields into legitimate websites that are intended to trick him into entering social security numbers or other sensitive information. When the user types the data into the field, it is transmitted back to the malware author.

“CSIS finds this crimekit to be quite disturbing news since MacOS previously to some degree has been spared from the increasing amount of malware which has haunted Windows-based systems for years,” the firm's Peter Kruse wrote in a blog post published on Monday.

The bulletin was published the same day that Mac antivirus provider Intego warned of a new piece of Mac malware called Mac Defender that fraudulently posed as legitimate security software for OS X. Besides making false claims that a target's Mac is infected, it causes browsers to open up pages from hard core porn sites, giving the impression that the machine is under someone else's control

So-called rogue antivirus software has been using similar techniques to menace Windows users for years.

KrebsOnSecurity has a video here that shows Weyland-Yutani in action. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Bad PUPPY: Undead Windows XP deposits fresh scamware on lawn
Installing random interwebs shiz will bork your zombie box
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.