Over the weekend, I got an e-mail from an AppleCare support rep, who was responding to my recent reports of Mac malware being found in the wild. At least one prominent voice in the Mac community dismisses these reports as “crying wolf.” The view from inside an Apple call center says it’s for real:
I can tell you for a fact, many, many people are falling for this attack. Our call volume here at AppleCare is 4-5x higher than normal and [the overwhelming majority] of our calls are about this Mac Defender and its aliases. Many frustrated Mac users think their Mac is impervious to viruses and think this is a real warning from Apple. I really wish I could say not many people will fall for this, but in this last week, we have had nothing but Mac Defender and similar calls.
I contacted this person and arranged an interview. I’ve edited our conversation to remove any details that might identify this individual or the call center location, but otherwise this is a verbatim transcript.
Update In the Talkback comments, some people express skepticism about these conclusions. Be sure to read my follow-up: Crying wolf? Apple support forums confirm malware explosion. It includes direct quotes from Apple customers caught up by this attack.
EB: Until this latest round of fake AV software started, what was a typical week like for you?
AC: There’s usually about 600 or so of us spread around 14 centers for CPU support. Before this started happening, we had 7-12 minutes between calls generally. Now we’re lucky to have any time between calls.
We started getting a trickle of calls a couple weeks ago. However, this last week over 50% of our calls have been about it. In two days last week I personally took 60 calls that referred to Mac Defender.
EB: Do you have a support database that you share for cases like this?
AC: What do you mean? As in articles for new issues we’re running into?
EB: Yes, there must have been a point where you noticed that a lot of people were dealing with this Mac Defender thing and that it wasn’t just your calls.
AC: We have a team of people who go though all case notes and find new issues that are popping up a lot and send notices to all of AppleCare. Our notice for Mac Defender is that we’re not supposed to help customers remove malware from their computer.
EB: Wow.
AC: That’s about what i said when I read it. The reason for the rule, they say, is that even though Mac Defender is easy to remove, we can’t set the expectation to customers that we will be able to remove all malware in the future. That’s what antivirus is for.
EB: I would imagine most of the people who are calling are fairly panic-stricken.
AC: Well, I’m sure you’re aware of what Mac Defender pops up on your screen if you don’t buy it. Last call i got before the weekend was a mother screaming at her kids to get out of the room because she didn’t want them seeing the images. So, panicking, yes, I’d say that would be the situation usually. I had a teacher call about Mac Defender last week.
EB: So you are supposed to tell them that the Terms of Service don’t allow you to help them remove it, and they should … what?





