Mac malware Eleanor hijacks your local files and email
Malicious code masquerades as file converter
New Mac malware that locks people's files and recruit their laptops for botnets has been discovered by cybersecurity researchers.
The malware, known as Backdoor.MAC.Eleanor', was uncovered by Bitdefender, and it is the second bug found to specifically target the Mac OS X the first being KeRanger ransomware, which was discovered in March.
Bitdefender found Eleanor available on the busy software portal, MacUpdate, masquerading as a free app called EasyDoc Converter'. It claimed to convert a user's FreeOffice and SimpleStats docs to Microsoft Office (.docx) files, but performed no such action when it was run.
Instead, it offered hackers a way to blackmail users and take control of their devices.
"This type of malware is particularly dangerous as it's hard to detect and offers the attacker full control of the compromised system," said Tiberius Axinte, technical leader of Bitdefender Antimalware Lab.
"For instance, someone can lock you out of your laptop, threaten to blackmail you to restore your private files or transform your laptop into a botnet to attack other devices."
MacUpdate has since blocked the software on its site. Also, the app has not been issued with a certificate assigned to a registered Apple developer. For Mac users, this means it will be slightly tougher for them to be exposed to the malware, as, by default, Mac OS X does not open or install uncertified apps. However, committed users can bypass the security measure.
When the app is run, it first checks for the presence of online check-in masker, Little Snitch. If this app is not found, it then downloads malicious code onto the user's computer.
The malware installs three Mac LaunchAgents in the user's home folder, as well as a hidden folder with executable files.
The LaunchAgents files are named as Dropbox fragments, and include:
The three LaunchAgents files activate a Tor hidden service, a web service and a Pastebin agent, according to Bitdefender.
The Pastebin agent lists a victim's Tor address to the Pastebin text repository, where it could be retrieved by attackers.
Hackers using the Eleanor malware can access a computer's file system and administrator database, remotely execute script, and hijack email and email attachments.
Bitdefender's report claims the first upload to Pastebin by this malware occurred on 19 April the malware appears to have been listed on MacUpdate since 16 March.
Advice from cybersecurity firms is to download applications from reputable websites or directly from the developer, and avoid old or abandoned apps.
The case for a marketing content hub
Transform your digital marketing to deliver customer expectationsDownload now
Fast, flexible and compliant e-signatures for global businesses
Be at the forefront of digital transformation with electronic signaturesDownload now
Why CEOS should care about the move to SAP S/4HANA
And how they can accelerate business valueDownload now
IT faces new security challenges in the wake of COVID-19
Beat the crisis by learning how to secure your networkDownload now