Bundlore adware brings a new nest of risks to Mac users

guest · Jun 18, 2020

Bundlore adware brings a new nest of risks to Mac users
June 18, 2020
https://nakedsecurity.sophos.com/2020/06/18/bundlore-adware-brings-a-new-nest-of-risks-to-mac-users/

A decade or so ago, many Mac users used to claim very confidently that anti-virus software would be wasted on them, “because Macs don’t get malware.”

In fact, SophosLabs has just published a fascinating new report about an adware threat known as Bundlore that has Mac users very clearly in its sights.
Bundlore itself isn’t new – Sophos products have been detecting an adware family by that name on both Windows and Mac since about 2015 – but the operators behind it are certainly keeping up with the times.

As the name suggests, Bundlore isn’t really one item of adware, but what SophosLabs likes to call bundleware – a software installer that lures you in, for example with promises of enabling you to “download, play and organise third party files, video, audio and other content.”
Click to expand...

SophosLabs digs into the detail of two of these Bundlore plugins, called AnySearch and MyCouponSmart – the report unravels how these plugins work, written in a style that is technical enough to be insightful but not so technical that you need to be a web developer to understand the risks.

In particular, these plugins can hijack search results to earn affiliate credit for the Bundlore crew, alter search replies entirely to skew the results, and rewrite download links to fetch rogue content:

[A]dware operators are diversifying their sources of revenue. And, as demonstrated by the download link replacement behavior of these scripts, adware operators are ﬁnding new ways to leverage their control over web browsers’ content— and the result could be new privacy and security risks.
Click to expand...

Sophos: New Bundlore adware targets macOS with updated Safari extensions

We recently analyzed a particularly aggressive sample of what we refer to as “bundleware”—an unscrupulous software installer that drops multiple unwanted applications under the guise of installing one legitimate application—targeting macOS Catalina users.

This installer carried a total of seven “potentially unwanted applications” (PUAs)—including three that targeted the Safari web browser for the injection of ads, hijacking of download links, and redirecting of search queries for the purpose of stealing users’ clicks to generate income
Click to expand...

What makes the recent macOS samples we found stand out from previous Bundlore versions is the way that they have been updated to keep up with the recent changes in macOS and Safari—in particular, Apple’s changes in the format for Safari browser extensions.
Click to expand...

Log in or Sign up

Bundlore adware brings a new nest of risks to Mac users

guest Guest

Log in or Sign up

Bundlore adware brings a new nest of risks to Mac users

guest Guest

Useful Searches