{"id":16017,"date":"2013-07-16T12:42:24","date_gmt":"2013-07-16T19:42:24","guid":{"rendered":"http:\/\/www.intego.com\/mac-security-blog\/?p=16017"},"modified":"2026-07-01T13:51:26","modified_gmt":"2026-07-01T20:51:26","slug":"new-mac-malware-janicab-uses-old-trick-to-hide","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/new-mac-malware-janicab-uses-old-trick-to-hide\/","title":{"rendered":"New Mac Malware Janicab Uses Old Trick To Hide"},"content":{"rendered":"

\"Mac<\/a><\/p>\n

A new threat has been discovered on VirusTotal which affects OS X, acting as spyware on affected systems. It uses an old trick that reverses the direction of text in order to hide its true file-extension and appear as a PDF file rather than an APP file. Like the recent FileSteal.B<\/a>, the file is signed with an Apple ID so that it can bypass the middle level of Gatekeeper security<\/a>.<\/p>\n

The trick the malware uses to hide its true extension relies on a special character that\u2019s designed to assist with transmitting information, regardless of what language is being used. Specifically, whether the language is read from right-to-left or left-to-right. This feature does cause some very strange behavior in various programs, as it may not be handled properly in all cases.<\/p>\n

For instance, while the right-to-left override could trick a user in the Downloads folder, it won’t do so in the Desktop folder.\u00a0Amazingly, the right-to-left override also alters the Quarantine warning dialog, such that the text is reversed.<\/p>\n

If the user accepts this very strange-looking quarantine warning, it runs a Python script that performs the following actions:<\/p>\n