Contrary to popular belief, cybercriminals target Mac systems – but most people don’t take these threats seriously enough.
SophosLabs has published an in-depth report, “New Bundlore Adware Targets MacOS with Updated Safari Extensions”, that report analyses an aggressive sample of what Sophos refers to as “bundleware”–an unscrupulous software installer that drops multiple unwanted applications under the guise of installing one legitimate application–targeting MacOS Catalina users.
This installer carries a total of seven “potentially unwanted applications” (PUAs) – including three that targeted the Safari web browser for the injection of ads, hijacking of download links, and redirecting of search queries for the purpose of stealing users’ clicks to generate income.
PUAs are among the most common privacy and security threats to MacOS. Since they can potentially steal personal data and act as a pathway for malvertising and other malware, Sophos (and other endpoint protection products) block PUAs as a rule.
Bundlore is one of the most common “bundleware” installers for the macOS platform–it accounts for nearly seven percent of all attacks against the MacOS platform detected by Sophos, making it the second most common “badware” threat affecting MacOS (with Genieo ranking first).
Bundlore is also a common threat to Windows, primarily carrying extensions for Google Chrome–and some of the code used to target Chrome is shared with the MacOS-targeting versions of the adware.
What makes the recent MacOS samples we found stand out from previous Bundlore versions is the way that they have been updated to keep up with the recent changes in MacOS and Safari–in particular, Apple’s changes in the format for Safari browser extensions.
Given that PUAs are the top non-Windows threats, we’re hoping you will cover the report, including this quote from author Xinran Wu, senior threat researcher at Sophos, about Bundlore.
“Potentially unwanted applications like Bundlore adware are the most common security threat to MacOS users,” says Wu. “Not only are adware developers updating their methods to adapt to recent changes in MacOS and Safari by Apple, but in some cases they’re also dropping multiple PUA payloads with a single installer.
“And these PUAs go beyond just injecting ads into websites, they’re redirecting where a user’s browser searches are sent for the purpose of stealing clicks for money and even changing links for software downloads.
“Users should exercise caution when downloading software from unknown sources and stay alert when an unfamiliar app tries to install Browser Extensions.”