This little-known malware strain threatens the privacy of Mac users
Sophos Labs has discovered a new software installer for macOS that installs multiple unwanted applications or “bundleware” on users’ systems under the guide of installing one legitimate application.
The installer, which is primarily targeting macOS Catalina users, includes a total of seven “potentially unwanted applications” (PUAs) including three that target Apple’s Safari web browser to inject ads, hijack download links and redirect search queries with the aim of stealing users’ clicks to generate income. In at least one case, the injected content was used for malvertising by showing a malicious ad that prompted users to download a fake Adobe Flash update.
Sophos has identified the installer as belonging to the Bundlore family. Bundlore is a common macOS bundleware installer family that accounts for nearly seven percent of all attacks detected by the security company targeting Apple’s operating system.
Bundlore is also used to target Windows users through extensions for Google Chrome and some of the code used to target Chrome is shared with the versions of the adware that target macOS.
Bundlelore
The recent macOS samples discovered by Sophos stand out from previous versions of Bundlore due to the fact that they have been updated to keep up with recent changes in macOS and Safari, particularly Apple’s changes to the format for Safari browser extensions.
The Bundlore sample analyzed contained multiple Safari extension payloads including two in the new App Extension format. However, these extensions were adware that contained code which injected new advertisements and download links and even redirected search queries from certain search engines. Based on code taken from a remote server that supports two extensions, Sophos discovered dozens of search affiliate names related to the ad injector and search modification payload as well as affiliate codes used to profit from visits to other sites.
PUAs are among the most common security threats to macOS because they can steal personal data and act as a pathway for both malvertising and other malware. Thankfully though, endpoint protection software is able to block PUAs and Apple’s XProtect feature in macOS can block known Bundlore payloads.
Sophos’ Sean Gallagher and Xinran Wu provided further insight on the security company’s findings in a blog post, saying:
“Based on these and other samples we’ve observed, it’s clear that adware developers are clearly embracing the transition to Safari App Extension format and are updating their payload scripts. Browser extensions are increasingly popular as applications move to the cloud, and web browsers become the most heavily-used component of operating systems. So they will correspondingly continue to be a target for scams such as adware.”
Sophos Labs has discovered a new software installer for macOS that installs multiple unwanted applications or “bundleware” on users’ systems under the guide of installing one legitimate application. The installer, which is primarily targeting macOS Catalina users, includes a total of seven “potentially unwanted applications” (PUAs) including three that target…
Recent Posts
- Nearly half of all Steam users are using Windows 11 — but why?
- Luminar, maker of lidar for autonomous driving, lays off 20 percent of its workforce
- Environmental journalism is under attack
- This sinister Omen gaming PC build just might keep you up at night
- More details emerge about Apple’s plans for AI in iOS 18
Archives
- May 2024
- April 2024
- March 2024
- February 2024
- January 2024
- December 2023
- November 2023
- October 2023
- September 2023
- August 2023
- July 2023
- June 2023
- May 2023
- April 2023
- March 2023
- February 2023
- January 2023
- December 2022
- November 2022
- October 2022
- September 2022
- August 2022
- July 2022
- June 2022
- May 2022
- April 2022
- March 2022
- February 2022
- January 2022
- December 2021
- November 2021
- October 2021
- September 2021
- August 2021
- July 2021
- June 2021
- May 2021
- April 2021
- March 2021
- February 2021
- January 2021
- December 2020
- November 2020
- October 2020
- September 2020
- August 2020
- July 2020
- June 2020
- May 2020
- April 2020
- March 2020
- February 2020
- January 2020
- December 2019
- November 2019
- December 2011