New Mac OS X Malware: Takes Screenshots, Uploads User Data to Unknown Servers

A new variant of the Imuler Trojan horse, targeting Mac OS X users, has been discovered by a security research firm called Intego; the company specialises in Mac-related software.

The latest iteration of this Trojan infiltrates the user's system disguised as an image file with .zip archives titled "Pictures and the Article of Renzin Dorjee.zip" and "FHM Feb Cover Girl Irina Shayk H-Res Pics.zip".

The problem is that default Mac OS X settings hide full file extensions, allowing malware to pass off as image icons with no extension tags and trick users into believing they are downloading real image or .zip files.

In a post published on its blog, Intego details how the malware works...

"The malware installs a backdoor at /tmp/.mdworker, and a process called .mdworker then launches. A launch-agent file is also installed at ~/library/LaunchAgents/checkvir.plist, along with an executable in the same folder, ensuring that the malware launches when the user logs into his or her Mac," the post states.

Once the malware infects a host system, it searches for user data and then attempts to upload screenshots of user data to designated servers without consent. Users are, however, being advised not to panic. There is, as yet, no evidence the infection has actually been reported on serious scales and the risk is considered to be minimal at this time.

Nevertheless, Mac users are being advised to reveal file extensions, as a precautionary measure.

The Texas-based firm has also urged users to report suspicious encounters to popular VirusTotal, which should ensure their systems are free of malware.

Now, in contrast to the Android and Windows OS, OS X and iOS are usually considered one of the most secure softwares in the world, which makes news of this malware slightly troubling.