Inside a Modern Mac Trojan
Summary: F-Secure analyzed Trojan-Dropper:OSX/Revir.A, a Mach-O binary that extracts a decoy PDF and a second binary into the Mac's /tmp directory, which then downloads a third binary that installs a backdoor. The backdoor copies itself to /users/%user%/library/LaunchAgents/checkvir with a matching .plist launch point so it persists after reboot, all without the user entering a password.
Why it matters: The malware runs entirely in the user's home directory and /tmp, so it never triggers the admin password prompt Mac users rely on as their proof that nothing can install without consent.
Read the original at Krebs on Security ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026