Mac Defender and its variants
Summary: Cisco Talos released Snort rule GID 1, SID 18944, which generates events for network traffic showing characteristic signs of numerous known fake antivirus variants for both Windows and OSX. Talos said it built the rule by analyzing more than 1000 samples of fake AV malware in its repository, and that ClamAV signatures for MacDefender were issued several days earlier and will be updated as new variants are discovered.
Why it matters: The rule was derived from more than 1000 fake AV samples and Talos warns it may produce false positives, so every alert it raises has to be investigated rather than trusted at face value.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026