Security Firm Intego Warns About New Mac Spyware Doing The Rounds

Security Firm Intego Warns About New Mac Spyware Doing The Rounds

Every few months, Mac security firm Intego pops up, waves their arms hysterically around and screams that the OS X sky is falling, having identified new malware in the wild. Rinse, repeat.

Their latest report is no different: Intego has identified 30 screensavers developed by a company called 7art and one app called Mishinc FLV to MP3 that are infected with a spyware program called OSX/OpinionSpy.

The app isn’t actually part of the software itself: it downloads during the installation of the original programs. It apparently runs as root, scans all accessible files on all drives, opens a back door using port 8254, and injects code into Safari, Firefox and iChat through Mac memory, beaming out its surreptitiously snooped data into the wild. Worse, it automatically relaunches even if you close the file.

Anyway, be warned: you probably don’t have it, given the obscurity of the programs in question, but if you notice your computer asking for your name or suggesting you fill out some forms and surveys, it’s probably time to break out the malware scanner.

DON'T MISS
Malicious iPhone Malware Steals Private Data From Jailbroken iPhones

[via The Apple Blog]

About the author

John BrownleeJohn Brownlee is news editor here at Cult of Mac, and has also written about a lot of things for a lot of different places, including Wired, Playboy, Boing Boing, Popular Mechanics, Gizmodo, Kotaku, Lifehacker, AMC, Geek and the Consumerist. He lives in Cambridge with his charming inamorata and a tiny budgerigar punningly christened after Nabokov's most famous pervert. You can follow him here on Twitter.

(sorry, you need Javascript to see this e-mail address)| Read more posts by .

Posted in News, Software |

  • Seong-Hoon Lee

    ouch, so everyone who watched po** have to download this?
    I bet that’s going to be 97% of all Mac users.
    Anyways, if the numbers of viruses are growing, then Intego will get more money in the future!

  • Conrad

    No, this has nothing to do with porn. This is from sites like Version Tracker and MacUpdate. Not xxx.com or whatever.

  • lolAsian

    @Asian Guy.

    They aint viruses you r-tard.

  • Mezzrow

    I had downloaded one of those screensavers over six months ago, so I ran a full system scan yesterday which found nothing. Then I deleted the screensaver.

    Oddly enough, just today I got an alert (first time ever) from ClamXav that it detected a virus on my Mac.

  • Daniel

    It seems that this company recently added this and that this particular spyware variant is pretty new. I messed with a 7art screensaver some time ago. It used a weird installation app, though I was able to find the actual .saver file. The screensaver in question was ugly so I deleted it immediately.

    Actually, I looked through all of their screensavers yesterday on MacUpdate. They were really gaudy, ugly clocks, that’s it. I think they used to have the nerve to charge for them, but obviously they’re not deserving of any money.

  • charli

    Spyware by its nature grabs stuff behind your back.

    this is NOT spyware because it is not doing that. It is an app by a market research company that will be install (if you okay it) along side the screensavers from this company. then you are asked to answer questions etc. The screensaver company gets money each time someone answers a survey from the app.