A new bit of malware is threatening Mac users, luring them with movie trailers.
Trojan.Yontoo.1 installs an adware plugin to Chrome, Safari and Firefox browsers.
The adware bothers users with additional ads, but even worse, may allow third parties to track where you surf on the Internet. Russian security firm Dr. Web discovered the virus.
“Adware for Mac OS X has been increasing in number since the beginning of 2013,” they wrote. “Trojon.Yontoo.1 is the most prominent of them: It can download and install an adware browser plugin in an infected system.”
One way the malware is getting on computers is by prompting users to download a plugin to watch movie trailers: “the prompt only imitates a common dialogue displayed when a plugin needs to be installed or additional configuration is necessary. After clicking on ‘Install the plug-in,’ the user is redirected to another site from which Trojan.Yontoo.1 is downloaded.”
As Dr. Web points out, Trojan.Yontoo.1 also masquerades as a download accelerator, a video enhancement program and a media player.
When a user launches the trojan, it brings up a dialogue box offering to install a program called “Free Twit Tube.” If selected, the installer will then download and install Yontoo for Firefox, Chrome and Safari, the three most popular Internet browsers for Apple computers. The adware plugin then begins sending information about what pages the user visits and sends that data to a remote server.
“In return, it gets a file that enables the Trojan to embed third-party code into pages visited by the user,” said Dr. Web. “This is how an apple.com page is displayed on an infected machine.”
The security firm also warned that similar methods were being used to spread the Trojan to PCs running Windows.
Beware of sketchy-looking plugins when you're looking for movie trailers, and if you come across something called (I can't believe we even have to say it) "Free Twit Tube," do not, under any circumstances, attempt to install it on your computer.
