Forest Global Training Partners

Cyber Risks · Cisco Talos

Mac "Trojans" this past weekend. OSX.Revir-1

Summary: Over the weekend, articles circulated about a "new" Mac Trojan called "Revir.A," which Cisco Talos obtained and analyzed after it first appeared on the F-Secure Blog. The sample, packaged as a .zip containing a .app with a Finder icon, displays a PDF named "Survey.pdf" asking users to take a "Product Satisfaction Survey," and Talos found it shared download methods, attack methods, and binary build methods with a similar sample seen in May.

Key Takeaway: Talos reports the embedded binary did not execute in its test suite and calls it "not a very good Trojan" - a reminder that widely reported "new" Mac malware can be a repackaged variant that existing ClamAV, Immunet, and Snort rules from May already detect.

Read the original at Cisco Talos ↗

Topics
Malware
Related