July 25, 2017 By Douglas Bonderud 3 min read

Back in January, a new piece of MacOS malware — dubbed Fruitfly — was found in the wild. As noted by Motherboard, this original strain wasn’t exactly far-reaching, infecting just four computers used by research centers. But this isn’t the whole story.

New research from security researcher Patrick Wardle found that Fruitfly malware had a much longer life cycle than expected, infecting and compromising hundreds of devices over the last decade.

Low Flier

According to Fortune, Wardle said that Fruitfly isn’t “the most sophisticated Mac malware,” but managed to fly under the radar for years anyway. While Apple released a patch for the strain found in January, version 2.0 of this bug continued to evade detection for another six months.

Thomas Reed of Malwarebytes, which initially discovered the malware, said the code uses ancient functions and rudimentary remote control to execute commands. Despite this basic construction, however, researchers remained uncertain about exactly how Fruitfly infects new targets. Wardle suspected that the method involves tricking users to click malicious links rather than exploiting MacOS flaws, but the bug remains stubbornly silent on its mechanism of action.

Interestingly, this newly discovered variant isn’t being used to target companies or security researchers, but average users across the U.S. According to CNET, Wardle found that 90 percent of the victims were in the U.S., with a larger concentration in Ohio. He believed that the malware is the work of a single cybercriminal looking to, as he put it, “spy on people for perverse reasons,” rather than a nation-state actor.

The (sort of) good news? Wardle said that the original attacker is likely missing in action, meaning users are no longer being actively targeted.

The High Threat of Fruitfly Malware

If attackers have bugged out, and this malware uses antiquated code, there’s not much to worry about, right? Not exactly.

According to Threatpost, the malware is designed to be interactive, with Wardle claiming it gives threat actors the ability to “move the mouse, generate presses and interact with the UI elements of the operating system.” It can also capture screenshots and keystrokes, turn on webcams and collect information about infected devices. It even comes with a built-in alert to let malicious actors know if victims are active on their devices, and might detect odd behavior.

To collect his data, Wardle decrypted several backup domains hardcoded into Fruitfly and then set up his own command-and-control server. Within two days, almost 400 infected devices were sending back information.

Interestingly, ransomware installs and banking credential theft aren’t part of the malware package, suggesting that the malware’s natural instinct was spying on everyday users rather than exploiting them for monetary gain. While Wardle didn’t interact with any infected computers, he did turn over all data to law enforcement, and all Fruitfly domains are now offline.

Don’t Bug Me

Researchers couldn’t find the right bug spray, but the Fruitfly malware seems to have naturally reached end of life. Still, two problems persist. First is overconfidence. While it’s unlikely that MacOS was compromised, many users remain convinced that Mac defenses will prevent any infection no matter how or where they surf the web.

The second problem is the ability of this malware to fly under the radar for years, even as it took complete control of victims’ devices. That it vanished when its creator(s) disappeared doesn’t solve the problem — its infection methods and abilities remain relative unknowns, meaning there’s plenty of room for new swarms to emerge and challenge MacOS security.

Fruitfly is a reminder that MacOS isn’t infallible, and malware isn’t one-size-fits-all. Even ordinary users are now under threat from bothersome bugs.

More from

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today