New MacKeeper Vulnerability Opens Mac Users Up to File Theft

Ask just about anyone who owns a Mac how secure they feel about the risk of installing malware on their beloved machine and most will answer that it really isn’t a concern. However, over the past few years there have been a few examples of harmful malware specifically designed to compromise Macs.

• In 2012, Flashback malware took advantage of a Java bug that allowed hackers to remotely do damage on the infected machine. In the end, over 600,000 Macs were infected.

• Another malware (called OSX/Agent-AADL, OSX/Callme.c, MACOS/CVE20090563.c, and other names) used a hole in Microsoft Word for Mac to target Chinese minority groups and take control over the machines. This zombie malware was discovered in 2013.

• And in 2014, the dangerous OSX/LaoShu-A (also known as OSX.laoshu, MacOS.LaoShu.A) Trojan was disguised in an “undelivered item” PDF document that stole documents, spreadsheets, and anything else that the criminals deemed important and sent them back to the crooks.

To continue the trend, a new one was recently found that is being referred to as OSX/Agent-ANTU. This one takes advantage of a security vulnerability in the Mac cleanup utility MacKeeper.

According to Sophos this new and improved malware used MacKeeper to trick users into visiting a “poisoned” website and use some relatively simple script to infect the machine, send it remote commands, and steal files.

Users of MacKeeper should ensure that software is updated. The company did quickly patch it once it was told of the issue. However, even if MacKeeper isn’t installed, this and other malware may still be able to find their way into the system.  

Ransomware, for example, doesn’t discriminate based on the operating system and can encrypt files until a sum of money is paid to unencrypt them. So it is recommended that even Mac users install anti-malware and make sure it’s updated at all times.

If ransomware does strike, never pay it. Instead, back up important files to an external drive or to the cloud and keep the backup current. That way, those files can always be restored from the backup and the money can be kept in your bank account.