New Apple Mac Trojan Called OSX/CoinThief Discovered
SecureMac has discovered a new Trojan Horse called OSX/CoinThief.A, which targets Mac OS X and spies on web traffic to steal Bitcoins. This malware has been found in the wild, and there are multiple user reports of stolen Bitcoins.
Context & Ripple Effects
This is the third act in a short arc of Mac threats moving from curiosity to cash-out. The corpus already shows a Mac OS X backdoor Trojan circulating in early 2011 and a Bitcoin-stealing malware wave reported that June — but CoinThief is the first entry here that combines the two: a Mac-native Trojan whose payload is specifically cryptocurrency theft.
The pickup pattern says something about how the story landed: eight outlets including The Mac Observer, ReadWrite, SecurityWeek and Digital Trends ran it within days, unusual breadth for an OS X threat and consistent with the 2012 observation that Windows and Android scams were being ported to the Mac as fake installers. Attackers are treating OS X as a monetizable platform, and Bitcoin holders on Macs as the target.
First-order effects
- Macs infected with OSX/CoinThief.A are leaking credentials and session data from web traffic right now, and SecureMac reports multiple users have already lost Bitcoins — anyone running an affected machine with coins held in browser-accessible wallets or exchange sessions is exposed until they detect and remove the Trojan.
Second-order effects
- Security vendors face immediate demand for CoinThief signatures and detection guidance for a platform many treated as low-priority, while wallet and exchange operators come under pressure to harden against stolen-session attacks rather than just stolen password files.
Third-order effects
- If the pattern from 2011 through this discovery holds, Mac's reputation as malware-resistant erodes as financially motivated actors follow the money into crypto holdings, pushing Apple toward the kind of active gatekeeping posture Windows users take for granted.
The trend: Malware economics are pulling OS X into the same monetized-threat ecosystem as Windows, with cryptocurrency theft emerging as the recurring payload that justifies targeting Mac users.