Menu
Home
People
Places
Arts
History
Plants & Animals
Science
Life & Culture
Technology
Reference.org
Mac Defender
open-in-new
<h2 id="symptoms">Symptoms</h2> <p>Users typically encounter the program when opening an image found on a search engine. It appears as a pop-up indicating that viruses have been detected on the users' computer and suggests they download a program which, if installed, provides the users' personal information to unauthorized third parties. </p><p>The program appears in malicious links spread by <a href="/facts/Spamdexing/V30auQyv">search engine optimization poisoning</a> on sites such as <a href="/facts/Google_Image_Search/fRJEAXHj">Google Image Search</a>.<a class="footnote-ref" id="fnref:14" href="#fn:14"><sup>14</sup></a> When a user accesses such a malicious link, a fake scanning window appears, originally in the style of a <a href="/facts/Windows_XP/IozrkAYS">Windows XP</a> application,<a class="footnote-ref" id="fnref:15" href="#fn:15"><sup>15</sup></a> but later in the form of an "Apple-type interface".<a class="footnote-ref" id="fnref:16" href="#fn:16"><sup>16</sup></a> The program falsely appears to scan the system's hard drive.<a class="footnote-ref" id="fnref:17" href="#fn:17"><sup>17</sup></a> The user is then prompted to download a file that installs Mac Defender, and is then asked to pay US$59.95 to US$79.95 for a license for the software.<a class="footnote-ref" id="fnref:18" href="#fn:18"><sup>18</sup></a> Rather than protect against viruses, Mac Defender hijacks the user's web browser to display sites related to <a href="/facts/Pornography/1chvn1Xt">pornography</a>, and also exposes the user to <a href="/facts/Identity_theft/WeTNe9DG">identity theft</a> (by passing on credit card information to the cracker).<a class="footnote-ref" id="fnref:19" href="#fn:19"><sup>19</sup></a><a class="footnote-ref" id="fnref:20" href="#fn:20"><sup>20</sup></a> A newer variant installs itself without needing the user to enter a password.<a class="footnote-ref" id="fnref:21" href="#fn:21"><sup>21</sup></a> All variants require the user to actively click through an installer to complete installation even if a password is not required.<a class="footnote-ref" id="fnref:22" href="#fn:22"><sup>22</sup></a> </p> <h2 id="origin">Origin</h2> <p>The software has been traced through German websites, which have been closed down, to the Russian <a href="/facts/Online_payment/WwzxAm8V">online payment</a> <a href="/facts/Pavel_Vrublevsky/UfJ3U334">ChronoPay</a>. Mac Defender was traced to ChronoPay by the email address of ChronoPay financial controller Alexandra Volkova.<a class="footnote-ref" id="fnref:23" href="#fn:23"><sup>23</sup></a> The email address appeared in domain registration for mac-defence.com and macbookprotection.com, two web sites Mac users are directed to in order to purchase the security software. <a href="/facts/Pavel_Vrublevsky/UfJ3U334">ChronoPay</a> is Russia's largest online payment processor. The web sites were hosted in Germany and were suspended by Czech registrar Webpoint.name. ChronoPay had earlier been linked to another scam in which users involved in file sharing were asked to pay a fine.<a class="footnote-ref" id="fnref:24" href="#fn:24"><sup>24</sup></a><a class="footnote-ref" id="fnref:25" href="#fn:25"><sup>25</sup></a> </p> <h2 id="apple-response">Apple response</h2> <p>According to Sophos, by 24 May, 2011, there had been sixty thousand calls to <a href="/facts/AppleCare/oAg5sVt8">AppleCare</a> technical support about Mac Defender-related issues,<a class="footnote-ref" id="fnref:26" href="#fn:26"><sup>26</sup></a> and Ed Bott of <a href="/facts/ZDNet/N69bLRQz">ZDNet</a> reported that the number of calls to AppleCare increased in volume due to Mac Defender and that a majority of the calls at that time pertained to Mac Defender.<a class="footnote-ref" id="fnref:27" href="#fn:27"><sup>27</sup></a> AppleCare employees were told not to assist callers in removing the software.<a class="footnote-ref" id="fnref:28" href="#fn:28"><sup>28</sup></a> Specifically, support employees were told not to instruct callers on how to use Force Quit and Activity Monitor to stop Mac Defender, as well as not to direct callers to any discussions pertaining to the problems caused by Mac Defender.<a class="footnote-ref" id="fnref:29" href="#fn:29"><sup>29</sup></a> An anonymous AppleCare support employee said that Apple instituted the policy in order to prevent users from relying on technical support instead of anti-virus programs.<a class="footnote-ref" id="fnref:30" href="#fn:30"><sup>30</sup></a> </p><p>AppleCare employees were told not to assist callers in removing the software, but Apple later promised a software patch.<a class="footnote-ref" id="fnref:31" href="#fn:31"><sup>31</sup></a> On 24 May 2011 Apple issued instructions on the prevention and removal of the malware.<a class="footnote-ref" id="fnref:32" href="#fn:32"><sup>32</sup></a> The Mac OS X security update 2011-003 was released on 31 May 2011, and includes not only an automatic removal of the trojan, and other security updates, but a new feature that automatically updates malware definitions from <a href="/facts/Apple_Inc./oTJYta3k">Apple</a>.<a class="footnote-ref" id="fnref:33" href="#fn:33"><sup>33</sup></a> </p> <h2 id="see-also">See also</h2> <ul><li><a href="/facts/Leap_(computer_worm)/Sz9X7EHE">Leap (computer worm)</a></li> <li><a href="/facts/Fakeflash/8AaHcQ6Y">Fakeflash</a></li></ul> <h2 id="references">References</h2> <ol> <li id="fn:1"><p>"About Security Update 2011-003". 31 May 2011. Retrieved 31 May 2011. <a href="http://support.apple.com/kb/HT4657" target="_blank">http://support.apple.com/kb/HT4657</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li> <li id="fn:2"><p>"Intego Mac Security Blog". 25 May 2001. Archived from the original on 27 May 2011. Retrieved 27 May 2011. <a href="https://web.archive.org/web/20110527094155/http://blog.intego.com/2011/05/25/intego-security-memo-new-mac-defender-variant-macguard-doesnt-require-password-for-installation/" target="_blank">https://web.archive.org/web/20110527094155/http://blog.intego.com/2011/05/25/intego-security-memo-new-mac-defender-variant-macguard-doesnt-require-password-for-installation/</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li> <li id="fn:3"><p>"Mac malware morphs to 'MacShield'". Technolog. MSNBC. Archived from the original on 6 June 2011. Retrieved 5 June 2011. <a href="https://web.archive.org/web/20110606015001/http://technolog.msnbc.msn.com/_news/2011/06/03/6780300-mac-malware-morphs-to-macshield" target="_blank">https://web.archive.org/web/20110606015001/http://technolog.msnbc.msn.com/_news/2011/06/03/6780300-mac-malware-morphs-to-macshield</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></p></li> <li id="fn:4"><p>"Threat Description: Rogue:OSX/FakeMacDef.A". F-Secure. Retrieved 11 February 2013. <a href="http://www.f-secure.com/v-descs/rogue_osx_fakemacdef_a.shtml" target="_blank">http://www.f-secure.com/v-descs/rogue_osx_fakemacdef_a.shtml</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></p></li> <li id="fn:5"><p>Hamburger, Ellis (2 May 2011). "WARNING: This Mac App Is Stealing Credit Card Numbers". Archived from the original on 25 April 2012. Retrieved 7 December 2011. <a href="https://web.archive.org/web/20120425203112/http://articles.businessinsider.com/2011-05-02/tech/29963959_1_credit-card-numbers-antivirus-rogue-program" target="_blank">https://web.archive.org/web/20120425203112/http://articles.businessinsider.com/2011-05-02/tech/29963959_1_credit-card-numbers-antivirus-rogue-program</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></p></li> <li id="fn:6"><p>"Macs face first virus threat". techday.co.nz. 4 May 2011. Archived from the original on 9 October 2011. Retrieved 27 May 2011. <a href="https://web.archive.org/web/20111009063519/http://www.techday.co.nz/netguide/news/macs-face-first-virus-threat/20020/" target="_blank">https://web.archive.org/web/20111009063519/http://www.techday.co.nz/netguide/news/macs-face-first-virus-threat/20020/</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></p></li> <li id="fn:7"><p>"Say hello to MAC Defender, the first major widespread piece of Mac based malware". left-click.us. Archived from the original on 26 June 2012. Retrieved 27 May 2011. <a href="https://web.archive.org/web/20120626231144/http://www.left-click.us/news/blog/mac-defender" target="_blank">https://web.archive.org/web/20120626231144/http://www.left-click.us/news/blog/mac-defender</a> <a href="#fnref:7" class="footnote-back-ref">↩</a></p></li> <li id="fn:8"><p>Dachis, Adam (25 May 2011). "How to Protect Your Computer from Mac Defender and Its Counterparts". Mac Defender has been making a lot of noise as one of the first major Mac security threats. lifehacker.com. <a href="https://lifehacker.com/5805609/how-to-protect-your-computer-from-mac-defender-and-macguard" target="_blank">https://lifehacker.com/5805609/how-to-protect-your-computer-from-mac-defender-and-macguard</a> <a href="#fnref:8" class="footnote-back-ref">↩</a></p></li> <li id="fn:9"><p>Dan Moren (2 May 2011). "New Mac Trojan horse masquerades as virus scanner". macworld.com. <a href="http://www.macworld.com/article/159595/2011/05/macdefender_trojan_horse.html" target="_blank">http://www.macworld.com/article/159595/2011/05/macdefender_trojan_horse.html</a> <a href="#fnref:9" class="footnote-back-ref">↩</a></p></li> <li id="fn:10"><p>Trenholm, Richard (20 May 2011). "Mac Defender fake antivirus software is first major attack on Apple computers". CNET. Retrieved 17 January 2023. <a href="https://www.cnet.com/tech/services-and-software/mac-defender-fake-antivirus-software-is-first-major-attack-on-apple-computers/" target="_blank">https://www.cnet.com/tech/services-and-software/mac-defender-fake-antivirus-software-is-first-major-attack-on-apple-computers/</a> <a href="#fnref:10" class="footnote-back-ref">↩</a></p></li> <li id="fn:11"><p>"Mac Defender fake antivirus software is first major attack on Apple computers". crave.cnet.co.uk. Archived from the original on 22 July 2011. Retrieved 27 May 2011. <a href="https://web.archive.org/web/20110722084915/http://crave.cnet.co.uk/software/mac-defender-fake-antivirus-software-is-first-major-attack-on-apple-computers-50003812/" target="_blank">https://web.archive.org/web/20110722084915/http://crave.cnet.co.uk/software/mac-defender-fake-antivirus-software-is-first-major-attack-on-apple-computers-50003812/</a> <a href="#fnref:11" class="footnote-back-ref">↩</a></p></li> <li id="fn:12"><p>< "Mac Guard: Apple users hit by second Mac malware scam". Christian Science Monitor Horizons blog. 26 May 2001. <a href="http://www.csmonitor.com/Innovation/Horizons/2011/0526/Mac-Guard-Apple-users-hit-by-second-Mac-malware-scam" target="_blank">http://www.csmonitor.com/Innovation/Horizons/2011/0526/Mac-Guard-Apple-users-hit-by-second-Mac-malware-scam</a> <a href="#fnref:12" class="footnote-back-ref">↩</a></p></li> <li id="fn:13"><p>"New Mac Defender Variant, MacGuard, Doesn't Require Password for Installation". Mac Security Blog from Intego. 25 May 2011. Archived from the original on 27 May 2011. Retrieved 27 May 2011. <a href="https://web.archive.org/web/20110527094155/http://blog.intego.com/2011/05/25/intego-security-memo-new-mac-defender-variant-macguard-doesnt-require-password-for-installation/" target="_blank">https://web.archive.org/web/20110527094155/http://blog.intego.com/2011/05/25/intego-security-memo-new-mac-defender-variant-macguard-doesnt-require-password-for-installation/</a> <a href="#fnref:13" class="footnote-back-ref">↩</a></p></li> <li id="fn:14"><p>Wisniewski, Chester (2 May 2011). "Mac users hit with fake anti-virus when using Google image search". Naked Security. Sophos. Retrieved 24 May 2011. <a href="https://nakedsecurity.sophos.com/2011/05/02/mac-users-hit-with-fake-av-when-using-google-image-search/" target="_blank">https://nakedsecurity.sophos.com/2011/05/02/mac-users-hit-with-fake-av-when-using-google-image-search/</a> <a href="#fnref:14" class="footnote-back-ref">↩</a></p></li> <li id="fn:15"><p>Wisniewski, Chester (2 May 2011). "Mac users hit with fake anti-virus when using Google image search". Naked Security. Sophos. Retrieved 24 May 2011. <a href="https://nakedsecurity.sophos.com/2011/05/02/mac-users-hit-with-fake-av-when-using-google-image-search/" target="_blank">https://nakedsecurity.sophos.com/2011/05/02/mac-users-hit-with-fake-av-when-using-google-image-search/</a> <a href="#fnref:15" class="footnote-back-ref">↩</a></p></li> <li id="fn:16"><p>Mills, Elinor (19 May 2011). "How bad is the Mac malware scare? (FAQ)". CNET. <a href="http://news.cnet.com/8301-27080_3-20064394-245.html" target="_blank">http://news.cnet.com/8301-27080_3-20064394-245.html</a> <a href="#fnref:16" class="footnote-back-ref">↩</a></p></li> <li id="fn:17"><p>Wisniewski, Chester (2 May 2011). "Mac users hit with fake anti-virus when using Google image search". Naked Security. Sophos. Retrieved 24 May 2011. <a href="https://nakedsecurity.sophos.com/2011/05/02/mac-users-hit-with-fake-av-when-using-google-image-search/" target="_blank">https://nakedsecurity.sophos.com/2011/05/02/mac-users-hit-with-fake-av-when-using-google-image-search/</a> <a href="#fnref:17" class="footnote-back-ref">↩</a></p></li> <li id="fn:18"><p>Wisniewski, Chester (2 May 2011). "Mac users hit with fake anti-virus when using Google image search". Naked Security. Sophos. Retrieved 24 May 2011. <a href="https://nakedsecurity.sophos.com/2011/05/02/mac-users-hit-with-fake-av-when-using-google-image-search/" target="_blank">https://nakedsecurity.sophos.com/2011/05/02/mac-users-hit-with-fake-av-when-using-google-image-search/</a> <a href="#fnref:18" class="footnote-back-ref">↩</a></p></li> <li id="fn:19"><p>Wisniewski, Chester (2 May 2011). "Mac users hit with fake anti-virus when using Google image search". Naked Security. Sophos. Retrieved 24 May 2011. <a href="https://nakedsecurity.sophos.com/2011/05/02/mac-users-hit-with-fake-av-when-using-google-image-search/" target="_blank">https://nakedsecurity.sophos.com/2011/05/02/mac-users-hit-with-fake-av-when-using-google-image-search/</a> <a href="#fnref:19" class="footnote-back-ref">↩</a></p></li> <li id="fn:20"><p>Chen, Brian X. (19 May 2011). "New Mac Malware Fools Customers, But Threat Still Relatively Small". Wired. Condé Nast Digital. Retrieved 24 May 2011. <a href="https://www.wired.com/gadgetlab/2011/05/mac-malware/" target="_blank">https://www.wired.com/gadgetlab/2011/05/mac-malware/</a> <a href="#fnref:20" class="footnote-back-ref">↩</a></p></li> <li id="fn:21"><p>"New Mac Defender Variant, MacGuard, Doesn't Require Password for Installation". The Mac Security Blog » INTEGO SECURITY MEMO. Archived from the original on 27 May 2011. Retrieved 27 May 2011. <a href="https://web.archive.org/web/20110527094155/http://blog.intego.com/2011/05/25/intego-security-memo-new-mac-defender-variant-macguard-doesnt-require-password-for-installation/" target="_blank">https://web.archive.org/web/20110527094155/http://blog.intego.com/2011/05/25/intego-security-memo-new-mac-defender-variant-macguard-doesnt-require-password-for-installation/</a> <a href="#fnref:21" class="footnote-back-ref">↩</a></p></li> <li id="fn:22"><p>"New Mac Defender Variant, MacGuard, Doesn't Require Password for Installation". The Mac Security Blog » INTEGO SECURITY MEMO. Archived from the original on 27 May 2011. Retrieved 27 May 2011. <a href="https://web.archive.org/web/20110527094155/http://blog.intego.com/2011/05/25/intego-security-memo-new-mac-defender-variant-macguard-doesnt-require-password-for-installation/" target="_blank">https://web.archive.org/web/20110527094155/http://blog.intego.com/2011/05/25/intego-security-memo-new-mac-defender-variant-macguard-doesnt-require-password-for-installation/</a> <a href="#fnref:22" class="footnote-back-ref">↩</a></p></li> <li id="fn:23"><p>"Apple takes on Mac Defender Scam". International Business Times. 29 May 2011. <a href="http://www.ibtimes.com/articles/154071/20110529/apple-takes-on-mac-defender-scam.htm" target="_blank">http://www.ibtimes.com/articles/154071/20110529/apple-takes-on-mac-defender-scam.htm</a> <a href="#fnref:23" class="footnote-back-ref">↩</a></p></li> <li id="fn:24"><p>"MacDefender Scareware Linked to Russian Payment Site". News & Opinion. PCMag.com. <a href="https://www.pcmag.com/article2/0,2817,2386060,00.asp" target="_blank">https://www.pcmag.com/article2/0,2817,2386060,00.asp</a> <a href="#fnref:24" class="footnote-back-ref">↩</a></p></li> <li id="fn:25"><p>"Russia's ChronoPay Executive Linked to Mac Defender Scam". International Business Times. <a href="http://www.ibtimes.com/articles/153863/20110528/russia-s-chronopay-linked-to-mac-scareware-scam.htm" target="_blank">http://www.ibtimes.com/articles/153863/20110528/russia-s-chronopay-linked-to-mac-scareware-scam.htm</a> <a href="#fnref:25" class="footnote-back-ref">↩</a></p></li> <li id="fn:26"><p>Wisniewski, Chester (24 May 2011). "Apple support to infected Mac users: 'You cannot show the customer how to stop the process'". Naked Security. Sophos. Retrieved 24 May 2011. <a href="https://nakedsecurity.sophos.com/2011/05/24/apple-support-to-infected-mac-users-you-cannot-show-the-customer-how-to-stop-the-process/" target="_blank">https://nakedsecurity.sophos.com/2011/05/24/apple-support-to-infected-mac-users-you-cannot-show-the-customer-how-to-stop-the-process/</a> <a href="#fnref:26" class="footnote-back-ref">↩</a></p></li> <li id="fn:27"><p>Bott, Ed (18 May 2011). "An AppleCare support rep talks: Mac malware is "getting worse"". ZDNet. Retrieved 24 May 2011. <a href="https://www.zdnet.com/article/an-applecare-support-rep-talks-mac-malware-is-getting-worse/" target="_blank">https://www.zdnet.com/article/an-applecare-support-rep-talks-mac-malware-is-getting-worse/</a> <a href="#fnref:27" class="footnote-back-ref">↩</a></p></li> <li id="fn:28"><p>Cluley, Graham (18 May 2011). "Malware on your Mac? Don't expect AppleCare to help you remove it". Naked Security. Sophos. Retrieved 24 May 2011. <a href="https://nakedsecurity.sophos.com/2011/05/18/malware-on-your-mac-dont-expect-applecare-to-help-you-remove-it/" target="_blank">https://nakedsecurity.sophos.com/2011/05/18/malware-on-your-mac-dont-expect-applecare-to-help-you-remove-it/</a> <a href="#fnref:28" class="footnote-back-ref">↩</a></p></li> <li id="fn:29"><p>Wisniewski, Chester (24 May 2011). "Apple support to infected Mac users: 'You cannot show the customer how to stop the process'". Naked Security. Sophos. Retrieved 24 May 2011. <a href="https://nakedsecurity.sophos.com/2011/05/24/apple-support-to-infected-mac-users-you-cannot-show-the-customer-how-to-stop-the-process/" target="_blank">https://nakedsecurity.sophos.com/2011/05/24/apple-support-to-infected-mac-users-you-cannot-show-the-customer-how-to-stop-the-process/</a> <a href="#fnref:29" class="footnote-back-ref">↩</a></p></li> <li id="fn:30"><p>Cluley, Graham (18 May 2011). "Malware on your Mac? Don't expect AppleCare to help you remove it". Naked Security. Sophos. Retrieved 24 May 2011. <a href="https://nakedsecurity.sophos.com/2011/05/18/malware-on-your-mac-dont-expect-applecare-to-help-you-remove-it/" target="_blank">https://nakedsecurity.sophos.com/2011/05/18/malware-on-your-mac-dont-expect-applecare-to-help-you-remove-it/</a> <a href="#fnref:30" class="footnote-back-ref">↩</a></p></li> <li id="fn:31"><p>"Mac malware authors release a new, more dangerous version". ZDNet. 25 May 2011. <a href="https://www.zdnet.com/article/mac-malware-authors-release-a-new-more-dangerous-version/" target="_blank">https://www.zdnet.com/article/mac-malware-authors-release-a-new-more-dangerous-version/</a> <a href="#fnref:31" class="footnote-back-ref">↩</a></p></li> <li id="fn:32"><p>"How to avoid or remove Mac Defender malware". 24 May 2011. Retrieved 1 June 2011. <a href="http://support.apple.com/kb/ht4650" target="_blank">http://support.apple.com/kb/ht4650</a> <a href="#fnref:32" class="footnote-back-ref">↩</a></p></li> <li id="fn:33"><p>"About Security Update 2011-003". 31 May 2011. Retrieved 31 May 2011. <a href="http://support.apple.com/kb/HT4657" target="_blank">http://support.apple.com/kb/HT4657</a> <a href="#fnref:33" class="footnote-back-ref">↩</a></p></li> </ol>