Mac OS X Malware found in pirated Apple iWork 09

Researchers at Intego have intercepted a Mac OS X malware threat circulating in pirated copies of Apple's iWork 09 software.

The malicious file, dubbed OSX.Trojan.iServices.A, was found on BitTorrent trackers and other sites containing links to pirated software.  The booby-trapped version of the iWord 09 productivity suite is complete and functional but the installer contains an additional package called iWorkServices.pkg, Intego said.

When installing iWork 09, the iWorkServices package is installed. The installer for the Trojan horse is launched as soon as a user begins the installation of iWork, following the installer’s request of an administrator password (in older versions of Mac OS X, 10.5.1 or earlier, there will be no password request). This software is installed as a startup item (in /System/Library/StartupItems/iWorkServices, a location reserved normally for Apple startup items), where it has read-write-execute permissions for root. The malicious software connects to a remote server over the Internet; this means that a malicious user will be alerted that this Trojan horse is installed on different Macs, and will have the ability to connect to them and perform various actions remotely. The Trojan horse may also download additional components to an infected Mac.

[ Mac Attack: Porn video lures dropping DNS-changer Trojan ]

The company said at least 20,000 Mac users have already downloaded the rigged installer.

The risk of infection is serious, and users may face extremely serious consequences if their Macs are accessible to malicious users.

Although malware attacks on the Mac operating system have been limited, they do exist, especially on the DNS-changing front. Mac OS X users are urged to avoid downloading and installing software from untrusted sources or questionable Web sites.