{"id":4297,"date":"2023-12-15T06:25:24","date_gmt":"2023-12-15T06:25:24","guid":{"rendered":"https:\/\/cleanerone.trendmicro.com\/blog\/?p=4297"},"modified":"2023-12-15T06:25:24","modified_gmt":"2023-12-15T06:25:24","slug":"new-trojan-proxy-malware","status":"publish","type":"post","link":"https:\/\/cleanerone.trendmicro.com\/blog\/new-trojan-proxy-malware\/","title":{"rendered":"New Trojan-Proxy Malware Targets Mac Users via Pirated Software"},"content":{"rendered":"

What is Trojan-Proxy malware?<\/strong><\/h2>\n

Cybercriminals are intensifying their assault on Mac users with a sophisticated Trojan-Proxy malware campaign, as reported by cybersecurity firm Kaspersky. This cross-platform threat targets users seeking free versions of popular macOS software on unauthorized websites. The malware infiltrates computers through pirated tools, transforming them into traffic-forwarding terminals for anonymizing criminal activities such as hacking, phishing, and transactions for illicit goods.<\/p>\n

The campaign strategically capitalizes on users\u2019 willingness to compromise their computer\u2019s security to obtain premium apps without payment. Kaspersky identified 35 trojanized tools, including image editing, video compression, data recovery, and network scanning software, offered on warez sites. Notable trojanized software includes 4K Video Downloader Pro, Aiseesoft Mac Data Recovery, Sketch, and more.<\/p>\n

\"\"<\/picture><\/p>\n

How does Trojan-Proxy malware work?<\/strong><\/h2>\n

The Trojan-Proxy malware disguises itself within PKG files, unlike legitimate software distributed as disk images (.DMG). This malicious tactic allows the execution of scripts during the installation process, posing significant risks. With administrator rights granted during installation, the embedded scripts perform dangerous actions like file modification, autorun, and command execution.<\/p>\n

Upon installation, the malware activates the Trojan-Proxy, masquerading as the WindowServer process to blend with routine system operations and evade user scrutiny. The WindowServer is a legitimate macOS system process responsible for managing the graphic user interface. The Trojan-Proxy connects to its command and control (C2) server via DNS-over-HTTPS (DoH) to receive operational commands. The C2 infrastructure supports proxy trojan payloads for Android and Windows, indicating a broader target range.<\/p>\n

In a parallel discovery, Kaspersky found evidence of a related Trojan-Proxy malware affecting Apple macOS users through unauthorized websites distributing trojanized versions of cracked software. This sophisticated threat operates as a cross-platform menace, with artifacts suggesting a connection to Windows and Android.<\/p>\n

The macOS variants of the malware present themselves as legitimate multimedia, image editing, data recovery, and productivity tools, mainly targeting users seeking pirated software. The rogue versions, delivered through .PKG installers, contain post-install scripts for malicious activation. To enhance its stealth, the malware mimics the WindowServer process and communicates with its C2 server through encrypted DNS-over-HTTPS.<\/p>\n

 <\/p>\n

How to protect your Mac against Trojan-Proxy malware?<\/strong><\/h2>\n

Both Kaspersky’s warnings highlight the severity of the threat and advise users to refrain from downloading software from untrusted sources. By staying vigilant and avoiding pirated software, users can contribute to mitigating the risks associated with these Trojan-Proxy malware campaigns.<\/p>\n

However, if you\u2019re concerned that malicious malware has been installed on your device, you can download Antivirus One<\/strong><\/a> to check for free. Once your Mac gets infected, the malware will keep creating malicious files. The longer you wait, the more damage will be done to your computer. Antivirus One<\/strong><\/a> is a professional and reliable antivirus app, which performs superbly across the board in malware detection and threat protection. It offers live antivirus monitoring to protect your Mac from adware, ransomware, spyware, and all kinds of malware attacks.<\/p>\n

Additionally, if your device has already been affected by the Trojan-Proxy malware, you can use Antivirus One<\/strong><\/a> to run a comprehensive scan and thoroughly eliminate the adware and any related items.<\/p>\n

\"\"<\/picture>Here are some of Antivirus One\u2019s awesome features:<\/p>\n