Newly uncovered Mac malware is not only in the wild, but trying to avoid detection by security researchers, according to one such firm.
Dubbed "CrescentCore," the malware comes as it usually does -- in the form of a DMG file pretending to be an Adobe Flash Player installer, Intego said. If someone launches its contents, the software will check to see if it's running inside a virtual machine -- a way researchers often quarantine their subjects.
The malware also checks for several popular antivirus tools, and if it detects them, will simply stop running. If there's nothing in the way one version will install "LaunchAgent," described as a "persistent infection," while another will install either "Advanced Mac Cleaner" or a Safari extension.
CrescentCore can be found on multiple websites, including one claiming to offer free downloads of new comic books, Intego warned. Another is said to be "a high-ranking Google search result" that redirects visitors through multiple websites, ultimately trying to trick people into a fake Flash update.
"As a general rule, nobody should be installing Flash Player in 2019 -- not even the real, legitimate one," Intego commented. HTML5 and other technologies have made Flash obsolete, and Adobe itself is ending development and distribution of Flash Player by the end of 2020. The plugin was disabled by default in 2016's macOS Sierra, and has never been available in iOS.
For years Flash has been a
CrescentCore is signed with multiple developer IDs registered to a "Sanela Lovic," which Apple has already disabled. Intego's own antivirus software is already scrubbing the code.