The HandBrake forum announcement contains manual removal instructions and advises users who find the malware on their Macs to change all of the passwords stored in their macOS keychains or browsers. The Trojan software installs itself as a program called activity_agent.app and sets up a Launch Agent called fr.handbrake.activity_ist to start it every time the user logs in. In order to obtain admin privileges, the malicious HandBrake installer asked victims for their password under the guise of installing additional video codecs, Wardle said.
It has all of the features typically found in such programs: keylogging, remote access via SSH or VNC, and the ability to execute shell commands as root, grab webcam and desktop screen shots, steal files and more. Proton is a remote access tool (RAT) sold on cybercrime forums since earlier this year. Users of version 0.10.5 and earlier who used the built-in updater and all users who downloaded the program manually during those five days might be affected, so they should check their systems.Īccording to an analysis by Patrick Wardle, director of security research at Synack, the trojanized version of HandBrake distributed from the compromised mirror contained a new version of the Proton malware for macOS.
Users of HandBrake 1.0 and later who upgraded to version 1.0.7 through the program's built-in update mechanism shouldn't be affected, because the updater verifies the program's digital signature and wouldn't have accepted the malicious file.
0 kommentar(er)
