July 25, 2017 By Douglas Bonderud 3 min read

Back in January, a new piece of MacOS malware — dubbed Fruitfly — was found in the wild. As noted by Motherboard, this original strain wasn’t exactly far-reaching, infecting just four computers used by research centers. But this isn’t the whole story.

New research from security researcher Patrick Wardle found that Fruitfly malware had a much longer life cycle than expected, infecting and compromising hundreds of devices over the last decade.

Low Flier

According to Fortune, Wardle said that Fruitfly isn’t “the most sophisticated Mac malware,” but managed to fly under the radar for years anyway. While Apple released a patch for the strain found in January, version 2.0 of this bug continued to evade detection for another six months.

Thomas Reed of Malwarebytes, which initially discovered the malware, said the code uses ancient functions and rudimentary remote control to execute commands. Despite this basic construction, however, researchers remained uncertain about exactly how Fruitfly infects new targets. Wardle suspected that the method involves tricking users to click malicious links rather than exploiting MacOS flaws, but the bug remains stubbornly silent on its mechanism of action.

Interestingly, this newly discovered variant isn’t being used to target companies or security researchers, but average users across the U.S. According to CNET, Wardle found that 90 percent of the victims were in the U.S., with a larger concentration in Ohio. He believed that the malware is the work of a single cybercriminal looking to, as he put it, “spy on people for perverse reasons,” rather than a nation-state actor.

The (sort of) good news? Wardle said that the original attacker is likely missing in action, meaning users are no longer being actively targeted.

The High Threat of Fruitfly Malware

If attackers have bugged out, and this malware uses antiquated code, there’s not much to worry about, right? Not exactly.

According to Threatpost, the malware is designed to be interactive, with Wardle claiming it gives threat actors the ability to “move the mouse, generate presses and interact with the UI elements of the operating system.” It can also capture screenshots and keystrokes, turn on webcams and collect information about infected devices. It even comes with a built-in alert to let malicious actors know if victims are active on their devices, and might detect odd behavior.

To collect his data, Wardle decrypted several backup domains hardcoded into Fruitfly and then set up his own command-and-control server. Within two days, almost 400 infected devices were sending back information.

Interestingly, ransomware installs and banking credential theft aren’t part of the malware package, suggesting that the malware’s natural instinct was spying on everyday users rather than exploiting them for monetary gain. While Wardle didn’t interact with any infected computers, he did turn over all data to law enforcement, and all Fruitfly domains are now offline.

Don’t Bug Me

Researchers couldn’t find the right bug spray, but the Fruitfly malware seems to have naturally reached end of life. Still, two problems persist. First is overconfidence. While it’s unlikely that MacOS was compromised, many users remain convinced that Mac defenses will prevent any infection no matter how or where they surf the web.

The second problem is the ability of this malware to fly under the radar for years, even as it took complete control of victims’ devices. That it vanished when its creator(s) disappeared doesn’t solve the problem — its infection methods and abilities remain relative unknowns, meaning there’s plenty of room for new swarms to emerge and challenge MacOS security.

Fruitfly is a reminder that MacOS isn’t infallible, and malware isn’t one-size-fits-all. Even ordinary users are now under threat from bothersome bugs.

More from

Airplane cybersecurity: Past, present, future

4 min read - With most aviation processes now digitized, airlines and the aviation industry as a whole must prioritize cybersecurity. If a cyber criminal launches an attack that affects a system involved in aviation — either an airline’s system or a third-party vendor — the entire process, from safety to passenger comfort, may be impacted.To improve security in the aviation industry, the FAA recently proposed new rules to tighten cybersecurity on airplanes. These rules would “protect the equipment, systems and networks of transport…

Protecting your digital assets from non-human identity attacks

4 min read - Untethered data accessibility and workflow automation are now foundational elements of most digital infrastructures. With the right applications and protocols in place, businesses no longer need to feel restricted by their lack of manpower or technical capabilities — machines are now filling those gaps.The use of non-human identities (NHIs) to power business-critical applications — especially those used in cloud computing environments or when facilitating service-to-service connections — has opened the doors for seamless operational efficiency. Unfortunately, these doors aren’t the…

Communication platforms play a major role in data breach risks

4 min read - Every online activity or task brings at least some level of cybersecurity risk, but some have more risk than others. Kiteworks Sensitive Content Communications Report found that this is especially true when it comes to using communication tools.When it comes to cybersecurity, communicating means more than just talking to another person; it includes any activity where you are transferring data from one point online to another. Companies use a wide range of different types of tools to communicate, including email,…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today