/
Navigation
Chronicles
Browse all articles
Explore
Semantic exploration
Research
Entity momentum
Nexus
Correlations & relationships
Story Arc
Topic evolution
Drift Map
Semantic trajectory animation
Posts
Analysis & commentary
Pulse API
Tech news intelligence API
Browse
Entities
Companies, people, products, technologies
Domains
Browse by publication source
Handles
Browse by social media handle
Detection
Concept Search
Semantic similarity search
High Impact Stories
Top coverage by position
Sentiment Analysis
Positive/negative coverage
Anomaly Detection
Unusual coverage patterns
Analysis
Rivalry Report
Compare two entities head-to-head
Semantic Pivots
Narrative discontinuities
Crisis Response
Event recovery patterns
Connected
Search: /
Command: ⌘K
Embeddings: large
TEXXR

Chronicles

The story behind the story

← → days · ↑ ↓ browse · Enter similar · o open

DNS changer Trojan for Mac (!) in the wild

We received some reports of various companies (http://www.intego.com/news/ ism0705.asp) reporting about a Mac DNS changer Trojan in the wild.  As I happened to receive a sample of it, I decided to analyze it quickly.

SANS Internet Storm Center, InfoCON Bojan Zdrnja

Context & Ripple Effects

Intego's October 31 security alert flagged a DNS changer Trojan circulating against Macs inside various companies, and within a day SANS Internet Storm Center handlers had obtained a live sample of their own to analyze rather than relying on secondhand vendor reports.

The significance is less the individual binary than what it signals: a monetizable, redirect-traffic Trojan aimed at OS X at a moment when most corporate endpoint defenses assume Macs are not worth attacking.

First-order effects

  • Machines infected by this Trojan have their DNS resolver settings rewritten, so affected companies' Mac users can be silently steered to attacker-controlled lookups without any visible compromise.
  • Security teams that excluded Macs from their Windows-centric malware monitoring now have a confirmed, in-the-wild sample forcing them to treat OS X endpoints as in scope.

Second-order effects

  • Mac-focused security vendors such as Intego gain a concrete sales argument with enterprise buyers, shifting detection tooling demand from optional to budgeted for mixed Windows-Mac fleets.
  • DNS-based redirection puts pressure on registrars and DNS operators as the choke point where hijacked lookups can be detected or blocked, since endpoint cleanup alone does not undo poisoned caches.

Third-order effects

  • If DNS-hijacking proves profitable on OS X, the platform's low-attacker-interest era erodes structurally, pushing Apple and enterprise buyers toward built-in verification and default-deny controls rather than reliance on market share as a defense.
  • Repeated incidents of this class would push incident-response practice toward treating name-resolution integrity as a monitored control across all operating systems, not a Windows-only concern.

The trend: Mac malware is crossing from proof-of-concept curiosity to operationally profitable attacks, with DNS manipulation an early monetization vector.