Fake security software takes aim at Mac users

'Rogueware' plague expands from Windows to Mac OS, tries to dupe Apple users into paying $60-$80

Scammers are distributing fake security software aimed at the Mac by taking advantage of the news that al-Qaeda leader Osama Bin Laden has been killed by U.S. forces, a security researcher said today.

A security firm that specializes in Mac software called the move "a very big step forward" for malware makers targeting Apple's users.

Phony antivirus software, dubbed "rogueware" by security experts, has long plagued people running Microsoft Windows, but this is the first time scammers have targeted the Mac with a sophisticated, professional-looking security application, said Peter James, a spokesman for Intego, a Mac-only antivirus company headquartered in France.

"This is indeed a very big step forward for Mac malware," said James.

The program, dubbed MAC Defender, is similar to existing "rogueware," the term for bogus security software that claims a personal computer is heavily infected with malware. Once installed, such software nags users with pervasive pop-ups and fake alerts until they fork over a fee to purchase the worthless program.

Until now, rogueware has been exclusively targeting Windows PCs.

That's changed, according to Kurt Baumgartner, a senior malware researcher with Moscow-based Kaspersky Lab, who today said that one group distributing MAC Defender has also been actively spreading Windows rogueware.

"They have been revving up for this for months," said Baumgartner of the work to prep MAC Defender.

Last month, Baumgartner had reported that ".co.cc" domains -- which are often used to spread malware and host attack code-infected Web sites -- had begun to host fake security sites and deliver the "Best AntiVirus 2011" rogueware.

During his early-April sweep through the .co.cc domains, Baumgartner found a URL explicitly aimed at Macs: "antispyware-macbook(dot)co(dot)cc".

"It is very odd that this group is marketing 'Fast Windows Antivirus 2011' from 'macbook' domains," Baumgartner said at the time in a blog post.

Today, Baumgartner said that a group using .co.cc domains was serving up fake security software for Macs as part of a broader campaign to trick Windows users into downloading and installing phony programs.

That campaign is currently exploiting the hot news topic of Bin Laden's death to get people to click on links that redirect their browsers to the rogueware downloads. The scammers have used "black hat" SEO (search engine optimization) tactics to push links to rogueware higher on Google Images' search results.

But that's not the only way Mac owners have been duped into installing MAC Defender.

On Saturday -- the day before President Obama announced the killing of Bin Laden -- messages from infected users began appearing on Apple's support forums.

"What is macdefender and why is it trying to install itself on my computer?" asked someone identified as "wamabahama" on April 30.

The first fake AV targeting Macs makes false claims that the machine is heavily infected. (Image: Intego Security.)

"FYI, my daughter said the program started after clicking on a 'hair style photo,'" added "Mr. Fix It Home Services" on the same support thread. Others reported stumbling upon MAC Defender after searching for images of prom tuxedos or for pictures of a character in the movie "Princess Bride."

On Monday, Intego published a detailed advisory about MAC Defender, noting that that it was "very well designed, and looks professional."

Intego spotted MAC Defender and acquired samples on Saturday, said James, who pointed out that users must enter their administrative password to install the program. "So there's still a social engineering angle here," he said.

In fact, users see a generic Windows-oriented page when they first click a link to the rogueware. "They're not even getting a Mac-specific page," James said.

But unless users have Safari set not to automatically open files after downloading, MAC Defender's installation screen opens without any user action. That's been enough to con some into approving the install by typing their administrative password.

The program also relies on an unusual technique to make users pay up.

"Every few minutes, it opens a porn page in the browser," said James of MAC Defender. "We think they're doing this because most people will assume that that means they've got a virus on their Mac, and they need to get rid of it by paying for the program."

MAC Defender demands $60-$80, depending on whether users select a one-year, two-year or lifetime "license."

Ironically, there are only eight to 10 serial numbers that MAC Defender accepts, said James, and those are tucked into the binary file -- unencrypted -- where advanced users may be able to root them out.

James also called out the MAC Defender's look and feel as an indicator that the criminals are serious about reaping profits from Mac users. "This was done by a very sophisticated Mac interface developer," James said. "It's an obvious sign that [scammers] are starting to target Macs. Earlier [scams], such as 2008's MacSweeper just didn't bother trying to look professional."

Intego spotted MacSweeper, a fake Macintosh system cleaning program, in January 2008.

MAC Defender has also created some collateral damage: The rogueware uses the same name as a legitimate German company that develops Mac software.

"A new malware application named MAC Defender (MacDefender.app) for OS X surfaced a few days ago," warned the MacDefender site. "If you see an application/installer named like this DO NOT DOWNLOAD/INSTALL it. I would never release an application named like this."

The rogueware's name choice was probably a twist on "PC Defender" and "Windows Defender," phrases used in the titles of numerous Windows-based fake AV programs, said James.

Mac users running Safari can prevent MAC Defender from automatically opening after it downloads by unchecking the box marked "Open 'safe' files after downloading" at the bottom of the General tab in the browser's Preferences screen.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed. His e-mail address is gkeizer@computerworld.com.

Read more about security in Computerworld's Security Topic Center.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags Cybercrime and HackingMac OSsecurityMicrosoftSecurity Hardware and SoftwareIntegosoftwareoperating systemskaspersky labApple

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)
Show Comments

Cool Tech

Xiro Drone Xplorer V -3 Axis Gimbal & 1080p Full HD 14MP Camera

Learn more >

ASUS ROG Swift PG279Q – Reign beyond virtual world

Learn more >

D-Link TAIPAN AC3200 Ultra Wi-Fi Modem Router (DSL-4320L)

Learn more >

D-Link PowerLine AV2 2000 Gigabit Network Kit

Learn more >

Crucial® BX200 SATA 2.5” 7mm (with 9.5mm adapter) Internal Solid State Drive

Learn more >

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

Gadgets & Things


Learn more >

Lexar Professional 2000x SDHC™/SDXC™ UHS-II cards

Learn more >

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

Family Friendly

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

Lexar Professional 2000x SDHC™/SDXC™ UHS-II cards

Learn more >

ASUS VivoPC VM62 - Incredibly Powerful, Unbelievably Small

Learn more >

Stocking Stuffer

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

Lexar Professional 2000x SDHC™/SDXC™ UHS-II cards

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Best Deals on Good Gear Guide


Latest News Articles


GGG Evaluation Team

Kathy Cassidy


First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni


For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell


The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi


The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott


My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.


Latest Jobs


Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?