Mac malware Eleanor hijacks your local files and email

New Mac malware that locks people's files and recruit their laptops for botnets has been discovered by cybersecurity researchers.

The malware, known as Backdoor.MAC.Eleanor', was uncovered by Bitdefender, and it is the second bug found to specifically target the Mac OS X the first being KeRanger ransomware, which was discovered in March.

Bitdefender found Eleanor available on the busy software portal, MacUpdate, masquerading as a free app called EasyDoc Converter'. It claimed to convert a user's FreeOffice and SimpleStats docs to Microsoft Office (.docx) files, but performed no such action when it was run.

Instead, it offered hackers a way to blackmail users and take control of their devices.

"This type of malware is particularly dangerous as it's hard to detect and offers the attacker full control of the compromised system," said Tiberius Axinte, technical leader of Bitdefender Antimalware Lab.

"For instance, someone can lock you out of your laptop, threaten to blackmail you to restore your private files or transform your laptop into a botnet to attack other devices."

MacUpdate has since blocked the software on its site. Also, the app has not been issued with a certificate assigned to a registered Apple developer. For Mac users, this means it will be slightly tougher for them to be exposed to the malware, as, by default, Mac OS X does not open or install uncertified apps. However, committed users can bypass the security measure.

When the app is run, it first checks for the presence of online check-in masker, Little Snitch. If this app is not found, it then downloads malicious code onto the user's computer.

The malware installs three Mac LaunchAgents in the user's home folder, as well as a hidden folder with executable files.

The LaunchAgents files are named as Dropbox fragments, and include:

~/Library/LaunchAgents/com.getdropbox.dropbox.integritycheck.plist

~/Library/LaunchAgents/com.getdropbox.dropbox.timegrabber.plist

~/Library/LaunchAgents/com.getdropbox.dropbox.usercontent.plist

~/Library/.dropbox/

The three LaunchAgents files activate a Tor hidden service, a web service and a Pastebin agent, according to Bitdefender.

The Pastebin agent lists a victim's Tor address to the Pastebin text repository, where it could be retrieved by attackers.

Hackers using the Eleanor malware can access a computer's file system and administrator database, remotely execute script, and hijack email and email attachments.

Bitdefender's report claims the first upload to Pastebin by this malware occurred on 19 April the malware appears to have been listed on MacUpdate since 16 March.

Advice from cybersecurity firms is to download applications from reputable websites or directly from the developer, and avoid old or abandoned apps.