{"id":14007,"date":"2013-04-26T08:59:08","date_gmt":"2013-04-26T15:59:08","guid":{"rendered":"http:\/\/www.intego.com\/mac-security-blog\/?p=14007"},"modified":"2026-07-01T13:55:00","modified_gmt":"2026-07-01T20:55:00","slug":"new-targeted-attack-against-uyghur-mac-users-hitting-the-news","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\/","title":{"rendered":"New Targeted Attack Against Uyghur Mac Users Has Been Hitting the News"},"content":{"rendered":"<p>A new targeted attack against Uyghur Mac users has been hitting the news. The threat is similar to <a href=\"https:\/\/www.intego.com\/mac-security-blog\/new-targeted-attack-on-tibetan-activists-using-os-x-discovered\/\">OSX\/CallMe.A<\/a>\u00a0we reported earlier this year and is already detected by <a title=\"Intego VirusBarrier\" href=\"https:\/\/www.intego.com\/features\/virus-scanner\">Intego VirusBarrier<\/a>.<\/p>\n<p>The new sample use the same Word vulnerability, CVE-2009-0563, <a title=\"MS09-027\" href=\"\/\/technet.microsoft.com\/en-us\/security\/bulletin\/ms09-027\">patched by Microsoft on June 9th, 2009<\/a>.\u00a0It drops a backdoor for PowerPC and Intel Macs that masquerades as a Real Player Updater, just like another variant seen on <a title=\"Antivirus scan for bf7625a4b6284ce3efa485f833e08440\" href=\"https:\/\/www.virustotal.com\/en\/file\/54258b853ed3ee4d19cf5edec8d59640eff1b36e171b87a1ee48fa0a480e47fd\/analysis\/\">VirusTotal on February 19th, 2013<\/a>.\u00a0When triggered, it seeks persistence using <em>launchd<\/em> and can even relaunch itself with superuser privileges, abusing <em>sudo<\/em> command and its grace period.<\/p>\n<p>The malicious binary is a port of Tiny SHell for OS X. It also sends the infected user&#8217;s Contact information, the AddressBook &#8220;Me&#8221; card, to its C&amp;C server (this behavior require user interaction since the introduction of OS X Mountain Lion&#8217;s new Privacy features).<\/p>\n<p>All these facts indicate the attack is specifically targeting people:<\/p>\n<ul>\n<li>using OS X prior to Mountain Lion;<\/li>\n<li>using Microsoft Office 2004 prior to 11.5.5 update or;<\/li>\n<li>using Microsoft Office 2008 prior to the 12.1.9 update;<\/li>\n<li>eventually comfortable with Terminal application.<\/li>\n<\/ul>\n<p>The various samples we are aware of create the following files:<\/p>\n<ul>\n<li>~\/Library\/Application Support\/.realPlayerUpdate<\/li>\n<li>~\/library\/launchagents\/.systm<\/li>\n<li>~\/library\/launchagents\/apple.plist<\/li>\n<li>~\/library\/launchagents\/realPlayerUpdate.plist<\/li>\n<li>\/Library\/Application Support\/.realPlayerUpdate<\/li>\n<li>\/library\/LaunchDaemons\/.systm<\/li>\n<li>\/library\/LaunchDaemons\/apple.plist<\/li>\n<li>\/library\/LaunchDaemons\/realPlayerUpdate.plist<\/li>\n<\/ul>\n<p>They contact the following hosts:<\/p>\n<ul>\n<li>alma.apple.cloudns.org<\/li>\n<li>apple12.crabdance.com<\/li>\n<li>update.googmail.org<\/li>\n<\/ul>\n<p>They all encrypt their communications with the C&amp;C server with the same AES key: 12345678. Once again, <a href=\"https:\/\/www.intego.com\/features\/virus-scanner\">Intego Virus Barrier<\/a> users with up-to-date definitions will detect this threat.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A new targeted attack against Uyghur Mac users has been hitting the news. The threat is similar to OSX\/CallMe.A\u00a0we reported earlier this year and is already detected by Intego VirusBarrier. The new sample use the same Word vulnerability, CVE-2009-0563, patched by Microsoft on June 9th, 2009.\u00a0It drops a backdoor for PowerPC and Intel Macs that [&hellip;]<\/p>\n","protected":false},"author":29,"featured_media":8763,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[190,5],"tags":[30,381,86,168,379],"class_list":["post-14007","post","type-post","status-publish","format-standard","has-post-thumbnail","category-malware","category-security-news","tag-backdoor","tag-callme","tag-mac-malware","tag-os-x","tag-targeted-attack"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"A new targeted attack against Uyghur Mac users has been hitting the news. The threat is similar to OSX\/CallMe.A we reported earlier this year and is already detected by Intego VirusBarrier. The new sample use the same Word vulnerability, CVE-2009-0563, patched by Microsoft on June 9th, 2009. It drops a backdoor for PowerPC and Intel Macs that\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Arnaud Abbati\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.intego.com\/mac-security-blog\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"The Mac Security Blog - Keep Macs safe from the dangers of the Internet\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"New Targeted Attack Against Uyghur Mac Users Has Been Hitting the News\" \/>\n\t\t<meta property=\"og:description\" content=\"A new targeted attack against Uyghur Mac users has been hitting the news. The threat is similar to OSX\/CallMe.A we reported earlier this year and is already detected by Intego VirusBarrier. The new sample use the same Word vulnerability, CVE-2009-0563, patched by Microsoft on June 9th, 2009. It drops a backdoor for PowerPC and Intel Macs that\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.intego.com\/mac-security-blog\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\/\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2013-04-26T15:59:08+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-07-01T20:55:00+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/integogroup\/\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@IntegoSecurity\" \/>\n\t\t<meta name=\"twitter:title\" content=\"New Targeted Attack Against Uyghur Mac Users Has Been Hitting the News\" \/>\n\t\t<meta name=\"twitter:description\" content=\"A new targeted attack against Uyghur Mac users has been hitting the news. The threat is similar to OSX\/CallMe.A we reported earlier this year and is already detected by Intego VirusBarrier. The new sample use the same Word vulnerability, CVE-2009-0563, patched by Microsoft on June 9th, 2009. It drops a backdoor for PowerPC and Intel Macs that\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@IntegoSecurity\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\\\/#blogposting\",\"name\":\"New Targeted Attack Against Uyghur Mac Users Has Been Hitting the News\",\"headline\":\"New Targeted Attack Against Uyghur Mac Users Has Been Hitting the News\",\"author\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/author\\\/aabbati\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/wp-content\\\/uploads\\\/2012\\\/12\\\/MalwareAlert-intego.jpg\",\"width\":400,\"height\":260,\"caption\":\"Malware Alert from Intego\"},\"datePublished\":\"2013-04-26T08:59:08-07:00\",\"dateModified\":\"2026-07-01T13:55:00-07:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\\\/#webpage\"},\"articleSection\":\"Malware, Security News, Backdoor, CallMe, Malware, OS X, Targeted Attack, aabbati\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/category\\\/security-news\\\/#listItem\",\"name\":\"Security News\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/category\\\/security-news\\\/#listItem\",\"position\":2,\"name\":\"Security News\",\"item\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/category\\\/security-news\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\\\/#listItem\",\"name\":\"New Targeted Attack Against Uyghur Mac Users Has Been Hitting the News\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\\\/#listItem\",\"position\":3,\"name\":\"New Targeted Attack Against Uyghur Mac Users Has Been Hitting the News\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/category\\\/security-news\\\/#listItem\",\"name\":\"Security News\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#organization\",\"name\":\"The Mac Security Blog\",\"description\":\"Keep Macs safe from the dangers of the Internet\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/logo2.png\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\\\/#organizationLogo\",\"width\":122,\"height\":46},\"image\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/integogroup\\\/\",\"https:\\\/\\\/x.com\\\/IntegoSecurity\",\"https:\\\/\\\/www.instagram.com\\\/intego_security\\\/\",\"https:\\\/\\\/www.youtube.com\\\/user\\\/IntegoVideo\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/intego\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/author\\\/aabbati\\\/#author\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/author\\\/aabbati\\\/\",\"name\":\"Arnaud Abbati\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/0900d8690b71f7469d2052482f01e87f9d1595d251a363d3c8f183fbe91417f8?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"Arnaud Abbati\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\\\/#webpage\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\\\/\",\"name\":\"New Targeted Attack Against Uyghur Mac Users Has Been Hitting the News\",\"description\":\"A new targeted attack against Uyghur Mac users has been hitting the news. The threat is similar to OSX\\\/CallMe.A we reported earlier this year and is already detected by Intego VirusBarrier. The new sample use the same Word vulnerability, CVE-2009-0563, patched by Microsoft on June 9th, 2009. It drops a backdoor for PowerPC and Intel Macs that\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/author\\\/aabbati\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/author\\\/aabbati\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/wp-content\\\/uploads\\\/2012\\\/12\\\/MalwareAlert-intego.jpg\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\\\/#mainImage\",\"width\":400,\"height\":260,\"caption\":\"Malware Alert from Intego\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\\\/#mainImage\"},\"datePublished\":\"2013-04-26T08:59:08-07:00\",\"dateModified\":\"2026-07-01T13:55:00-07:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#website\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/\",\"name\":\"The Mac Security Blog\",\"description\":\"Keep Macs safe from the dangers of the Internet\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>New Targeted Attack Against Uyghur Mac Users Has Been Hitting the News<\/title>\n\n","aioseo_head_json":{"title":"New Targeted Attack Against Uyghur Mac Users Has Been Hitting the News","description":"A new targeted attack against Uyghur Mac users has been hitting the news. The threat is similar to OSX\/CallMe.A we reported earlier this year and is already detected by Intego VirusBarrier. The new sample use the same Word vulnerability, CVE-2009-0563, patched by Microsoft on June 9th, 2009. It drops a backdoor for PowerPC and Intel Macs that","canonical_url":"https:\/\/www.intego.com\/mac-security-blog\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\/#blogposting","name":"New Targeted Attack Against Uyghur Mac Users Has Been Hitting the News","headline":"New Targeted Attack Against Uyghur Mac Users Has Been Hitting the News","author":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/author\/aabbati\/#author"},"publisher":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2012\/12\/MalwareAlert-intego.jpg","width":400,"height":260,"caption":"Malware Alert from Intego"},"datePublished":"2013-04-26T08:59:08-07:00","dateModified":"2026-07-01T13:55:00-07:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\/#webpage"},"isPartOf":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\/#webpage"},"articleSection":"Malware, Security News, Backdoor, CallMe, Malware, OS X, Targeted Attack, aabbati"},{"@type":"BreadcrumbList","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.intego.com\/mac-security-blog#listItem","position":1,"name":"Home","item":"https:\/\/www.intego.com\/mac-security-blog","nextItem":{"@type":"ListItem","@id":"https:\/\/www.intego.com\/mac-security-blog\/category\/security-news\/#listItem","name":"Security News"}},{"@type":"ListItem","@id":"https:\/\/www.intego.com\/mac-security-blog\/category\/security-news\/#listItem","position":2,"name":"Security News","item":"https:\/\/www.intego.com\/mac-security-blog\/category\/security-news\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\/#listItem","name":"New Targeted Attack Against Uyghur Mac Users Has Been Hitting the News"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.intego.com\/mac-security-blog#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\/#listItem","position":3,"name":"New Targeted Attack Against Uyghur Mac Users Has Been Hitting the News","previousItem":{"@type":"ListItem","@id":"https:\/\/www.intego.com\/mac-security-blog\/category\/security-news\/#listItem","name":"Security News"}}]},{"@type":"Organization","@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization","name":"The Mac Security Blog","description":"Keep Macs safe from the dangers of the Internet","url":"https:\/\/www.intego.com\/mac-security-blog\/","logo":{"@type":"ImageObject","url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2026\/08\/logo2.png","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\/#organizationLogo","width":122,"height":46},"image":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\/#organizationLogo"},"sameAs":["https:\/\/www.facebook.com\/integogroup\/","https:\/\/x.com\/IntegoSecurity","https:\/\/www.instagram.com\/intego_security\/","https:\/\/www.youtube.com\/user\/IntegoVideo","https:\/\/www.linkedin.com\/company\/intego"]},{"@type":"Person","@id":"https:\/\/www.intego.com\/mac-security-blog\/author\/aabbati\/#author","url":"https:\/\/www.intego.com\/mac-security-blog\/author\/aabbati\/","name":"Arnaud Abbati","image":{"@type":"ImageObject","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/0900d8690b71f7469d2052482f01e87f9d1595d251a363d3c8f183fbe91417f8?s=96&d=mm&r=g","width":96,"height":96,"caption":"Arnaud Abbati"}},{"@type":"WebPage","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\/#webpage","url":"https:\/\/www.intego.com\/mac-security-blog\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\/","name":"New Targeted Attack Against Uyghur Mac Users Has Been Hitting the News","description":"A new targeted attack against Uyghur Mac users has been hitting the news. The threat is similar to OSX\/CallMe.A we reported earlier this year and is already detected by Intego VirusBarrier. The new sample use the same Word vulnerability, CVE-2009-0563, patched by Microsoft on June 9th, 2009. It drops a backdoor for PowerPC and Intel Macs that","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#website"},"breadcrumb":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\/#breadcrumblist"},"author":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/author\/aabbati\/#author"},"creator":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/author\/aabbati\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2012\/12\/MalwareAlert-intego.jpg","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\/#mainImage","width":400,"height":260,"caption":"Malware Alert from Intego"},"primaryImageOfPage":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\/#mainImage"},"datePublished":"2013-04-26T08:59:08-07:00","dateModified":"2026-07-01T13:55:00-07:00"},{"@type":"WebSite","@id":"https:\/\/www.intego.com\/mac-security-blog\/#website","url":"https:\/\/www.intego.com\/mac-security-blog\/","name":"The Mac Security Blog","description":"Keep Macs safe from the dangers of the Internet","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization"}}]},"og:locale":"en_US","og:site_name":"The Mac Security Blog - Keep Macs safe from the dangers of the Internet","og:type":"article","og:title":"New Targeted Attack Against Uyghur Mac Users Has Been Hitting the News","og:description":"A new targeted attack against Uyghur Mac users has been hitting the news. The threat is similar to OSX\/CallMe.A we reported earlier this year and is already detected by Intego VirusBarrier. The new sample use the same Word vulnerability, CVE-2009-0563, patched by Microsoft on June 9th, 2009. It drops a backdoor for PowerPC and Intel Macs that","og:url":"https:\/\/www.intego.com\/mac-security-blog\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\/","article:published_time":"2013-04-26T15:59:08+00:00","article:modified_time":"2026-07-01T20:55:00+00:00","article:publisher":"https:\/\/www.facebook.com\/integogroup\/","twitter:card":"summary_large_image","twitter:site":"@IntegoSecurity","twitter:title":"New Targeted Attack Against Uyghur Mac Users Has Been Hitting the News","twitter:description":"A new targeted attack against Uyghur Mac users has been hitting the news. The threat is similar to OSX\/CallMe.A we reported earlier this year and is already detected by Intego VirusBarrier. The new sample use the same Word vulnerability, CVE-2009-0563, patched by Microsoft on June 9th, 2009. It drops a backdoor for PowerPC and Intel Macs that","twitter:creator":"@IntegoSecurity"},"aioseo_meta_data":{"post_id":"14007","title":null,"description":null,"keywords":null,"keyphrases":null,"focus_keyword":null,"additional_keywords":null,"truseo_locale":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_custom_url":null,"og_image_custom_fields":null,"og_image_url":null,"og_image_width":null,"og_image_height":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_image_url":null,"twitter_title":null,"twitter_description":null,"schema_type":"default","schema_type_options":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"limit_modified_date":false,"ai":null,"breadcrumb_settings":null,"seo_analyzer_scan_date":"2026-08-28 06:38:41","created":"2026-08-28 06:38:41","updated":"2026-09-04 12:58:47","reviewed_by":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/www.intego.com\/mac-security-blog\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/www.intego.com\/mac-security-blog\/category\/security-news\/\" title=\"Security News\">Security News<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\tNew Targeted Attack Against Uyghur Mac Users Has Been Hitting the News\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.intego.com\/mac-security-blog"},{"label":"Security News","link":"https:\/\/www.intego.com\/mac-security-blog\/category\/security-news\/"},{"label":"New Targeted Attack Against Uyghur Mac Users Has Been Hitting the News","link":"https:\/\/www.intego.com\/mac-security-blog\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\/"}],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/14007","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/users\/29"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/comments?post=14007"}],"version-history":[{"count":12,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/14007\/revisions"}],"predecessor-version":[{"id":105328,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/14007\/revisions\/105328"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/media\/8763"}],"wp:attachment":[{"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/media?parent=14007"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/categories?post=14007"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/tags?post=14007"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}