The first ever crimeware kit targeting Apple’s Mac OS X has been spotted, featuring stark similarities to the popular Zeus toolset targeting Windows PCs.
The DIY kit grabs forms from Firefox running on the Apple OS, meaning passwords could be taken, alongside other information the victim types in the browser, Danish security firm CSIS reported.
Consisting of a builder and an admin panel, the kit has been advertised on a number of closed underground forums.
“The kit is being sold under the name Weyland-Yutani BOT and it is the first of its kind to hit the Mac OS platform. Apparently, a dedicated iPad and Linux release are under preparation as well,” said Peter Kruse, partner and security specialist at CSIS, in a blog post.
Kruse said the kit only enabled web injects and form grabbing in Firefox at the current time, but warned both Chrome and Safari “will soon follow.”
“CSIS finds this crimekit to be quite disturbing news since Mac OS previously to some degree has been spared from the increasing amount of malware which has haunted Windows-based systems for years,” he added.
“This could have resulted in a false sense of security that might make Mac OS user especially vulnerable to a sudden and highly sophisticated attack.”
Mac issues
Mac users can expect increasing numbers of attacks in the future as hackers look towards a wider range of platforms, according to experts.
Sophos today warned of a poisoned Google SEO attack affecting both Mac and Windows users.
A number of search terms have been targeted, including ones based around global warming and more current topics like Osama bin Laden's death, attempting to lure users into downloading a fake anti-virus program called MacDefender.
Even after infection, the user will be repeatedly bombarded with fake warning messages to encourage them to pay for non-existent threats to be removed, Sophos said.
This article originally appeared at itpro.co.uk
Copyright © ITPro, Dennis Publishing
A confirmation email has been sent to your email address - SUPPLIED GOES EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @itnews.com.au to your white-listed senders.