Mac Users Targeted with Ad-Based Image Malware

Most people think that there’s little if any, Mac malware in the civilized world. Unfortunately, that impression is just wishful thinking.

Well, we have seen how things shaped in 2018, and the increased targeting of the macOS platform by APT groups. We also saw how the criminals tried to exploit cryptomining and targeting those who are into cryptocurrency.

Even malware analysts those focused on Mac malware comes through so many malware samples in a day, but unfortunately not every new malware gets its own dedicated article.

Now just when we said this, we get to read a post by Lindsey O’Donnell on ThreatPost – ‘Malware in Ad-Based Images Targets Mac Users’. It reads that researchers detected 191,970 bad ads and estimates that around 1 million users Mac Users got impacted.

Researchers said the attacks have been happening January, 11, it spreads steganography by using ads on the web; it is a type of practice of concealing secret messages, code within otherwise innocent-looking text or images. The tactic has been in use over the past year, including in uploaded images on trusted Google sites and even in memes on Twitter.

A Mac user comes across an ad harboring an image – but in reality, a JavaScript malware is hiding within the image-file code in the ad. Once the user clicks on the malicious ad it infects the Mac user with the Shlayer trojan, which is disguised as a Flash player upgrade and redirects the victim to an adware installer.

Jerome Segura, head of Threat Intelligence with Malwarebytes say “The malware acts both as a Trojan and dropper for additional payloads, most notably Adware. As a result, end users may notice their machines running slower than normal and may be tricked into purchasing applications that they do not need.”

As said they have detected 191,970 bad ads so far, and estimate that around 1 million users have been impacted.

“The perpetrators, as it turns out, have been active for months, but only recently have they begun to smuggle in the malware by way of steganography through the use of image coding,” researchers said in a Wednesday post detailing the campaign.