Apple Mac user logins hunted by Flashback.G Trojan

Apple Mac users have been warned to be on the lookout for a new variant of the Flashback Java Trojan that has already hit an unknown number of victims running OS X 10.6 Snow Leopard.

The new Flashback.G documented by Mac security company Intego shows an interesting development in the sophistication of its social engineering.

The first targets Macs running versions of Java open to one of two common vulnerabilities. If these have been patched or Java is not installed (as would be the case by default when running OS X Lion), the malware throws up a dialog asking users to accept a bogus digital certificate claiming to be from Apple.

Anyone fooled by the ruse will be calling the install procedure for a browser login stealer that puts password-protected websites such as banking sites, PayPal and webmail at severe risk.  

According to Intego, a clue that a Mac has become infected is that the malware’s code injection renders applications such as Safari and Skype prone to frequent crashes. Users will also find a Java applet in ~/Library/Caches.

Despite the very low level of malware that targets the platform compared to Windows, there are signs that Apple now sees the appearance of more sophisticated Java malware as posing a real threat.

Last week the company showed a preview version of its future Mountain Lion OS X release featuring the ‘Gatekeeper’ security feature, a way of locking down which application providers can install apps of any kind on the OS.

Flashback first appeared in mid-2011 as a bogus app masquerading as an Adobe Flash player.

Twitter: @JohnEDunn