Mac spyware discovered on Angolan dissident's computer at Oslo Freedom Forum

Share this article:
FBI ransomware scam finds new home on the Mac
FBI ransomware scam finds new home on the Mac

Security researchers are studying an apparent new strain of Mac spyware that turned up on the computer of a participant at the just-concluded Oslo Freedom Forum, an annual human rights conference.

The backdoor was discovered by noted privacy and security researcher Jacob Appelbaum, who tweeted Thursday that it targeted the machine of an Angolan dissident. Angola is a southern African nation that has faced steep criticism for human rights abuses.

Analysts at security firm F-Secure studied the virus sample and learned that it was signed with a seemingly valid Apple Developer ID, steals screen shots and communicates with two command-and-control servers. F-Secure dubbed the malware OSX/KitM.A.

The spyware was discovered during a workshop that Appelbaum ran in which he instructed audience members on how to protect themselves from government surveillance.

The Oslo Freedom Forum event brings together "Influential dissidents, innovators, journalists, philanthropists, and policymakers" from around the world, according to the event's website.

Espionage malware built to run on Mac OS X machines is becoming increasingly common as more targets use the operating system.

UPDATE: Appelbaum said in a tweet that the activist's Mac was hit with the malware via a spear phishing attack.

UPDATE TWO: The SANS Internet Storm Center explained how it's possible to "verify and extract signatures and certificates on an Apple .app" as the attacker did in this instance.

Share this article:

Sign up to our newsletters

More in News

In Cisco probe, misuse or compromise spotted on all firms' networks

In Cisco probe, misuse or compromise spotted on ...

Cisco analyzed the business networks of 30 multinational companies last year, and revealed the findings in its 2014 Annual Security Report.

Fareit trojan observed spreading Necurs, Zbot and CryptoLocker

The Necurs and Zbot trojans, as well as CryptoLocker ransomware, has been observed by researchers as being spread through another trojan, known as Fareit.

Post Heartbleed, tech giants join initiative to bolster open source

Post Heartbleed, tech giants join initiative to bolster ...

The newly formed Core Infrastructure Initiative, created to boost under-funded open source projects, will tackle OpenSSL first.