{"id":455599,"date":"2022-08-05T13:00:32","date_gmt":"2022-08-05T11:00:32","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=455599"},"modified":"2022-08-05T13:01:22","modified_gmt":"2022-08-05T11:01:22","slug":"security-researcher-discovers-popular-mac-applications-riddled-with-malware","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/455599-security-researcher-discovers-popular-mac-applications-riddled-with-malware.html","title":{"rendered":"Security researcher discovers popular Mac applications riddled with malware"},"content":{"rendered":"<p>Security researcher Alex Kleber has <strong><a href=\"https:\/\/privacyis1st.medium.com\/abuse-of-the-mac-appstore-investigation-6151114bb10e\" target=\"_blank\" rel=\"noopener\">disclosed<\/a><\/strong> that seven different Apple developer accounts have abused the Apple Mac Store to distribute malware-infested applications.<\/p>\n<p>The developer accounts and applications and developer accounts associated with them are listed below with their rankings.<\/p>\n<ul>\n<li>PDF Reader for Adobe PDF Files \u2014 Sunnet Technology Inc \u2014 Top #1 US Chart Education<\/li>\n<li>Word Writer Pro \u2014 Netozo Limited \u2014 Top #52 US Chart Business<\/li>\n<li>Screen Recorder \u2014 Safeharbor Technology L Ltd \u2014 Top #12 US Chart Education<\/li>\n<li>Webcam Expert \u2014 Wildfire Technology Inc \u2014 Top #68 US Chart Photo &amp; Video<\/li>\n<li>Streaming Browser Video Player \u2014 Boulevard Technology Ltd \u2014 Top #8 US Chart Entertainment<\/li>\n<li>PDF Editor for Adobe Files \u2014 Polarnet Limited \u2014 Top #11 US Chart Business<\/li>\n<li>PDF Reader \u2014 Xu Lu \u2014 Top #25 US Chart Productivity<\/li>\n<\/ul>\n<p>Kleber said the same Chinese developer created most of the applications published under these accounts.<\/p>\n<p>The developer changed the applications\u2019 code remotely once the Apple review team approved it.<\/p>\n<p>Kleber explained this technique lets the developer change an application\u2019s user interface after it passes the Apple team\u2019s review.<\/p>\n<p>The researcher analysed the \u201cPDF Reader for Adobe PDF Files\u201d application and found it would launch and only let users do one thing \u2014 update the application.<\/p>\n<p>This would initiate the user interface change by activating the malicious code embedded in the application.<\/p>\n<p>Kleber said there is no option to cancel or exit the update window.<\/p>\n<p>\u201cThe user will not be able to quit the application without clicking that button \u2014 the only way to quit the application is by terminating the process using Activity Monitor.\u201d<\/p>\n<p>He said the applications would require users to pay for a subscription plan to use them.<\/p>\n<p>According to Kleber, bad actors would spam copycat applications from different developer accounts to gain as much market share as possible.<\/p>\n<p>He also noticed a pattern indicating that these applications use fake 5-star reviews to dupe consumers.<\/p>\n<p>\u201cThe pattern resides in the review text like the strange repeated use of all-caps APP, repeated use of \u201cwe\u201d and \u201cus\u201d as if the reviewer is representing an organisation.\u201d<\/p>\n<p>\u201cMost of the 5-star reviews in the US App Store appear to be non-native English,\u201d Kleber said.<\/p>\n<p>Since Kleber\u2019s report, Apple has removed the malicious applications and fake reviews from the Mac App Store.<\/p>\n<hr \/>\n<h3 class=\"my-4\">Now read: <a href=\"https:\/\/mybroadband.co.za\/news\/hardware\/453236-macbook-air-m2-prices-in-south-africa-revealed.html\">MacBook Air M2 prices in South Africa revealed<\/a><\/h3>\n","protected":false},"excerpt":{"rendered":"<p>Security researcher Alex Kleber has discovered several of the US Mac App Store&#8217;s most downloaded applications were riddled with stealth malware.<\/p>\n","protected":false},"author":341094,"featured_media":455601,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27],"tags":[80441,605,33436,33943,36626,80443],"class_list":["post-455599","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-alex-kleber","tag-apple","tag-fake-reviews","tag-mac-app-store","tag-macos","tag-stealth-malware"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/455599"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/341094"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=455599"}],"version-history":[{"count":1,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/455599\/revisions"}],"predecessor-version":[{"id":455603,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/455599\/revisions\/455603"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/455601"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=455599"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=455599"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=455599"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}