Mac malware Eleanor hijacks your local files and email

Malicious code masquerades as file converter

Cyber security skull

New Mac malware that locks people's files and recruit their laptops for botnets has been discovered by cybersecurity researchers.

The malware, known as Backdoor.MAC.Eleanor', was uncovered by Bitdefender, and it is the second bug found to specifically target the Mac OS X  the first being KeRanger ransomware, which was discovered in March.

Bitdefender found Eleanor available on the busy software portal, MacUpdate, masquerading as a free app called EasyDoc Converter'. It claimed to convert a user's FreeOffice and SimpleStats docs to Microsoft Office (.docx) files, but performed no such action when it was run.

Instead, it offered hackers a way to blackmail users and take control of their devices.

"This type of malware is particularly dangerous as it's hard to detect and offers the attacker full control of the compromised system," said Tiberius Axinte, technical leader of Bitdefender Antimalware Lab.

"For instance, someone can lock you out of your laptop, threaten to blackmail you to restore your private files or transform your laptop into a botnet to attack other devices."

MacUpdate has since blocked the software on its site. Also, the app has not been issued with a certificate assigned to a registered Apple developer. For Mac users, this means it will be slightly tougher for them to be exposed to the malware, as, by default, Mac OS X does not open or install uncertified apps. However, committed users can bypass the security measure.

When the app is run, it first checks for the presence of online check-in masker, Little Snitch. If this app is not found, it then downloads malicious code onto the user's computer.

The malware installs three Mac LaunchAgents in the user's home folder, as well as a hidden folder with executable files.

The LaunchAgents files are named as Dropbox fragments, and include:

~/Library/LaunchAgents/com.getdropbox.dropbox.integritycheck.plist

~/Library/LaunchAgents/com.getdropbox.dropbox.timegrabber.plist

~/Library/LaunchAgents/com.getdropbox.dropbox.usercontent.plist

~/Library/.dropbox/

The three LaunchAgents files activate a Tor hidden service, a web service and a Pastebin agent, according to Bitdefender.

The Pastebin agent lists a victim's Tor address to the Pastebin text repository, where it could be retrieved by attackers.

Hackers using the Eleanor malware can access a computer's file system and administrator database, remotely execute script, and hijack email and email attachments.

Bitdefender's report claims the first upload to Pastebin by this malware occurred on 19 April the malware appears to have been listed on MacUpdate since 16 March.

Advice from cybersecurity firms is to download applications from reputable websites or directly from the developer, and avoid old or abandoned apps.

Featured Resources

How to scale your organisation in the cloud

How to overcome common scaling challenges and choose the right scalable cloud service

Download now

The people factor: A critical ingredient for intelligent communications

How to improve communication within your business

Download now

Future of video conferencing

Optimising video conferencing features to achieve business goals

Download now

Improving cyber security for remote working

13 recommendations for security from any location

Download now

Recommended

MacBook users warned against EvilQuest ransomware
ransomware

MacBook users warned against EvilQuest ransomware

19 Feb 2021
Agent Tesla malware evades security controls to infect systems
malware

Agent Tesla malware evades security controls to infect systems

3 Feb 2021
Your essential guide to internet security
Security

Your essential guide to internet security

27 Jan 2021
Android malware vendor teams with marketer to promote new malware
malware

Android malware vendor teams with marketer to promote new malware

11 Jan 2021

Most Popular

Star Alliance passenger data stolen in SITA data breach
data breaches

Star Alliance passenger data stolen in SITA data breach

5 Mar 2021
I went shopping at Amazon’s till-less supermarket so that you don’t have to
automation

I went shopping at Amazon’s till-less supermarket so that you don’t have to

5 Mar 2021
How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

26 Feb 2021