Back in January, a new piece of MacOS malware — dubbed Fruitfly — was found in the wild. As noted by Motherboard, this original strain wasn’t exactly far-reaching, infecting just four computers used by research centers. But this isn’t the whole story.
New research from security researcher Patrick Wardle found that Fruitfly malware had a much longer life cycle than expected, infecting and compromising hundreds of devices over the last decade.
Low Flier
According to Fortune, Wardle said that Fruitfly isn’t “the most sophisticated Mac malware,” but managed to fly under the radar for years anyway. While Apple released a patch for the strain found in January, version 2.0 of this bug continued to evade detection for another six months.
Thomas Reed of Malwarebytes, which initially discovered the malware, said the code uses ancient functions and rudimentary remote control to execute commands. Despite this basic construction, however, researchers remained uncertain about exactly how Fruitfly infects new targets. Wardle suspected that the method involves tricking users to click malicious links rather than exploiting MacOS flaws, but the bug remains stubbornly silent on its mechanism of action.
Interestingly, this newly discovered variant isn’t being used to target companies or security researchers, but average users across the U.S. According to CNET, Wardle found that 90 percent of the victims were in the U.S., with a larger concentration in Ohio. He believed that the malware is the work of a single cybercriminal looking to, as he put it, “spy on people for perverse reasons,” rather than a nation-state actor.
The (sort of) good news? Wardle said that the original attacker is likely missing in action, meaning users are no longer being actively targeted.
The High Threat of Fruitfly Malware
If attackers have bugged out, and this malware uses antiquated code, there’s not much to worry about, right? Not exactly.
According to Threatpost, the malware is designed to be interactive, with Wardle claiming it gives threat actors the ability to “move the mouse, generate presses and interact with the UI elements of the operating system.” It can also capture screenshots and keystrokes, turn on webcams and collect information about infected devices. It even comes with a built-in alert to let malicious actors know if victims are active on their devices, and might detect odd behavior.
To collect his data, Wardle decrypted several backup domains hardcoded into Fruitfly and then set up his own command-and-control server. Within two days, almost 400 infected devices were sending back information.
Interestingly, ransomware installs and banking credential theft aren’t part of the malware package, suggesting that the malware’s natural instinct was spying on everyday users rather than exploiting them for monetary gain. While Wardle didn’t interact with any infected computers, he did turn over all data to law enforcement, and all Fruitfly domains are now offline.
Don’t Bug Me
Researchers couldn’t find the right bug spray, but the Fruitfly malware seems to have naturally reached end of life. Still, two problems persist. First is overconfidence. While it’s unlikely that MacOS was compromised, many users remain convinced that Mac defenses will prevent any infection no matter how or where they surf the web.
The second problem is the ability of this malware to fly under the radar for years, even as it took complete control of victims’ devices. That it vanished when its creator(s) disappeared doesn’t solve the problem — its infection methods and abilities remain relative unknowns, meaning there’s plenty of room for new swarms to emerge and challenge MacOS security.
Fruitfly is a reminder that MacOS isn’t infallible, and malware isn’t one-size-fits-all. Even ordinary users are now under threat from bothersome bugs.