{"id":21938,"date":"2014-01-20T14:58:15","date_gmt":"2014-01-20T22:58:15","guid":{"rendered":"http:\/\/www.intego.com\/mac-security-blog\/?p=21938"},"modified":"2026-07-04T02:21:29","modified_gmt":"2026-07-04T09:21:29","slug":"new-osx-crisis-variant-invokes-pope-francis","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/new-osx-crisis-variant-invokes-pope-francis\/","title":{"rendered":"New OSX\/Crisis Variant Invokes Pope Francis"},"content":{"rendered":"<p>A new sample of <a title=\"New Apple Mac Trojan Called OSX\/Crisis Discovered\" href=\"https:\/\/www.intego.com\/mac-security-blog\/new-apple-mac-trojan-called-osxcrisis-discovered-by-intego-virus-team\/\" target=\"_blank\">OSX\/Crisis<\/a>, the too popular Da Vinci rootkit from Hacking Team, <a title=\"Antivirus scan for 5a88ed9597749338dc93fe2dbfdbe684\" href=\"https:\/\/www.virustotal.com\/en\/file\/a2e3f93fc91cc4f0f5b28605371d89a6c4bdb3a7e841097dc7615bc2aa43a779\/analysis\/\" target=\"_blank\">reached our Malware Lab<\/a>\u00a0during the weekend.\u00a0We currently do not have information about the origin of the file on VirusTotal, named &#8220;Frantisek,&#8221; but it is an Eastern European first name meaning Francis. Could it be related to Pope Francis?<\/p>\n<p>Like the\u00a0<a title=\"New Apple Mac Trojan Called OSX\/Crisis Discovered\" href=\"https:\/\/www.intego.com\/mac-security-blog\/new-apple-mac-trojan-called-osxcrisis-discovered-by-intego-virus-team\/\" target=\"_blank\">previous<\/a>\u00a0<a title=\"New OSX\/Crisis or Business Cards Gone Wild\" href=\"https:\/\/www.intego.com\/mac-security-blog\/new-osx-crisis-business-cards-gone-wild\/\" target=\"_blank\">variants<\/a>,\u00a0OSX\/Crisis.C is delivered through a dropper that installs silently, without requiring a password, and works on Mac OS X 10.5, 10.6, and 10.7. However, Hacking Team has updated some of the dropper code and the backdoor configuration file format.<\/p>\n<p>The dropper executes an unusual segment: __INITSTUB. The original entry point EIP points to this code segment before reaching the almost empty _main function of the program. For this reason, an incautious researcher using a debugger could get infected without even noticing it.\u00a0While it uses a different way to resolve system symbols, it crashes on OS X Mountain Lion or OS X Mavericks (segmentation fault). This might be a 64-bit bug in the malware.<\/p>\n<p>Following is a screenshot of the resolved symbols hash of the dropper in\u00a0<a href=\"https:\/\/www.hex-rays.com\/products\/ida\/\" target=\"_blank\">IDA<\/a>:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-21960\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2014\/01\/crisis.c-hash-symbols.png\" alt=\"OSX\/Crisis.C - screenshot of the resolved symbols hash of the dropper in IDA\" width=\"489\" height=\"380\" srcset=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2014\/01\/crisis.c-hash-symbols.png 489w, https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2014\/01\/crisis.c-hash-symbols-150x116.png 150w, https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2014\/01\/crisis.c-hash-symbols-300x233.png 300w\" sizes=\"auto, (max-width: 489px) 100vw, 489px\" \/><\/p>\n<p>When the dropper runs successfully, it hides the following files in the user&#8217;s home directory (in the Library\/Preferences folder), inside a fake application bundle called\u00a0OvzD7xFr.app:<\/p>\n<ul>\n<li>1 backdoor: <a title=\"Antivirus scan for 4df3bce0bbc488119033dcfc0dc0a746\" href=\"https:\/\/www.virustotal.com\/en\/file\/890e3c5e057abd62ccbac73db75b2aba5de1e2a6d2eadada9dc770da4d57672b\/analysis\/1390242331\/\" target=\"_blank\"><em>8oTHYMCj.XIl<\/em><\/a> (32-bit)<\/li>\n<li>1 configuration file: <a title=\"Antivirus scan for aca104a944ae48847bb5b47431fd6012\" href=\"https:\/\/www.virustotal.com\/en\/file\/39f9901d9ef707d58d2bddea312871cdf964ba5872a74b2e1340db4799c8a2b2\/analysis\/1390242453\/\" target=\"_blank\"><em>ok20utla.3-B<\/em><\/a><\/li>\n<li>2 kernel extentions: <a title=\"Antivirus scan for 173daa0a7b020aaf044686df9430c1d6\" href=\"https:\/\/www.virustotal.com\/en\/file\/7fb5e5c464d8d6af28ab976afd4d86ef070741dd5e6716d37efd7bfcb6bf1aef\/analysis\/1390242784\/\" target=\"_blank\"><em>Lft2iRjk.7qa<\/em><\/a> (32-bit) and <a title=\"Antivirus scan for 3b00f4888cc8211aa7094a74ed198d06\" href=\"https:\/\/www.virustotal.com\/en\/file\/f940dcdcbc0093fc119f6d6e833f56464100f747861da475402557a3bc4f61ab\/analysis\/1390242959\/\" target=\"_blank\"><em>3ZPYmgGV.TOA<\/em><\/a> (64-bit)<\/li>\n<li>1 scripting addition: <a title=\"Antivirus scan for 209663d7067c2acad5ab0d010be37ed0\" href=\"https:\/\/www.virustotal.com\/en\/file\/2e19e30d0ba0cf8b5c8fc079b08b21c2038853b4b54fe9001814f8204e1281e2\/analysis\/\" target=\"_blank\"><em>EDr5dvW8.p_w<\/em><\/a> (FAT)<\/li>\n<li>1 <a title=\"XPC Interprocess Communication and Services\" href=\"https:\/\/developer.apple.com\/library\/mac\/documentation\/macosx\/conceptual\/osx_technology_overview\/SystemTechnology\/SystemTechnology.html\" target=\"_blank\">XPC service<\/a>: <a title=\"Antivirus scan for b2e05fb1c68bf4b4caa0523d3311290e\" href=\"https:\/\/www.virustotal.com\/en\/file\/b661d99e99cea1a0254d355549314f7e36fc359f5167344cd63e556773c5e014\/analysis\/1390243121\/\" target=\"_blank\"><em>GARteYof._Fk<\/em><\/a> (FAT)<\/li>\n<li>1 TIFF image, a System Preferences icon, ripped of <a title=\"Linkinus 2 - IRC for your Mac\" href=\"http:\/\/conceited.net\/products\/linkinus\" target=\"_blank\">Linkinus<\/a> preferences panel: <a title=\"Antivirus scan for 8c89f81d9ec8d9c018f162bb4ea2758f\" href=\"https:\/\/www.virustotal.com\/en\/file\/82dfff6a88fc519bb3e40186b725ed09105241ee9fa7a81de9e9fef323da69da\/analysis\/\" target=\"_blank\"><em>q45tyh<\/em><\/a><\/li>\n<\/ul>\n<p>Then it executes the backdoor and finishes the installation by creating a LaunchAgent file,\u00a0<a title=\"Antivirus scan for 143d763f2a0e44f8241805ac85d1e7e1\" href=\"https:\/\/www.virustotal.com\/en\/file\/1d76f819989a0e39a6a912b97cf3d4603b2574eaeff44acac94058ccc2cf2024\/analysis\/1390243989\/\" target=\"_blank\">com.apple.mdworker.plist<\/a>.<\/p>\n<p>Similar to\u00a0<a title=\"New OSX\/Crisis or Business Cards Gone Wild\" href=\"https:\/\/www.intego.com\/mac-security-blog\/new-osx-crisis-business-cards-gone-wild\/\" target=\"_blank\">OSX\/Crisis.B<\/a>, this binary is obfuscated using MPress packer. It doesn&#8217;t run on OS X 10.9 as it is linked against the Apple System Profiler private framework, SPSupport, which is now 64-bit only; an &#8220;Image not found&#8221; exception is raised, and then it crashes. Furthermore, on a supported target, the backdoor simply uninstalls its files and quits. This could be related to a corrupted configuration file (the sample one starts with NULL bytes).<\/p>\n<p>Other than a few new tricks, features implemented by the backdoor component are similar to previous variants: it patches the Activity Monitor application to hide itself, takes screenshots, captures audio and video, gathers user locations, connects to WiFi hotspots, syncs collected data with a Command and Control (C&amp;C) server, and tricks the user using social engineering to gain System Administrator privileges and drop its rootkit.<\/p>\n<p>At the time of this writing, the overhaul detection rate on VirusTotal is very low.<\/p>\n<p>Intego <a title=\"Intego VirusBarrier\" href=\"https:\/\/www.intego.com\/features\/virus-scanner\" target=\"_blank\">VirusBarrier<\/a> with up-to-date malware definitions protects Mac users against this malware, detected as <strong>OSX\/Crisis.C<\/strong>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A new sample of OSX\/Crisis, the too popular Da Vinci rootkit from Hacking Team, reached our Malware Lab\u00a0during the weekend.\u00a0We currently do not have information about the origin of the file on VirusTotal, named &#8220;Frantisek,&#8221; but it is an Eastern European first name meaning Francis. Could it be related to Pope Francis? Like the\u00a0previous\u00a0variants,\u00a0OSX\/Crisis.C is [&hellip;]<\/p>\n","protected":false},"author":29,"featured_media":8755,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[190,5],"tags":[840,86,703,862,839],"class_list":["post-21938","post","type-post","status-publish","format-standard","has-post-thumbnail","category-malware","category-security-news","tag-hacking-team","tag-mac-malware","tag-osxcrisis","tag-osxcrisis-c","tag-rcs"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"A new sample of OSX\/Crisis, the too popular Da Vinci rootkit from Hacking Team, reached our Malware Lab during the weekend. We currently do not have information about the origin of the file on VirusTotal, named &quot;Frantisek,&quot; but it is an Eastern European first name meaning Francis. Could it be related to Pope Francis? Like the previous variants, OSX\/Crisis.C is\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Arnaud Abbati\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.intego.com\/mac-security-blog\/new-osx-crisis-variant-invokes-pope-francis\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"The Mac Security Blog - Keep Macs safe from the dangers of the Internet\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"New OSX\/Crisis Variant Invokes Pope Francis\" \/>\n\t\t<meta property=\"og:description\" content=\"A new sample of OSX\/Crisis, the too popular Da Vinci rootkit from Hacking Team, reached our Malware Lab during the weekend. We currently do not have information about the origin of the file on VirusTotal, named &quot;Frantisek,&quot; but it is an Eastern European first name meaning Francis. Could it be related to Pope Francis? Like the previous variants, OSX\/Crisis.C is\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.intego.com\/mac-security-blog\/new-osx-crisis-variant-invokes-pope-francis\/\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2014-01-20T22:58:15+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-07-04T09:21:29+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/integogroup\/\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@IntegoSecurity\" \/>\n\t\t<meta name=\"twitter:title\" content=\"New OSX\/Crisis Variant Invokes Pope Francis\" \/>\n\t\t<meta name=\"twitter:description\" content=\"A new sample of OSX\/Crisis, the too popular Da Vinci rootkit from Hacking Team, reached our Malware Lab during the weekend. We currently do not have information about the origin of the file on VirusTotal, named &quot;Frantisek,&quot; but it is an Eastern European first name meaning Francis. Could it be related to Pope Francis? Like the previous variants, OSX\/Crisis.C is\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@IntegoSecurity\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-osx-crisis-variant-invokes-pope-francis\\\/#blogposting\",\"name\":\"New OSX\\\/Crisis Variant Invokes Pope Francis\",\"headline\":\"New OSX\\\/Crisis Variant Invokes Pope Francis\",\"author\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/author\\\/aabbati\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/wp-content\\\/uploads\\\/2012\\\/12\\\/MalwareAlert.png\",\"width\":400,\"height\":260},\"datePublished\":\"2014-01-20T14:58:15-08:00\",\"dateModified\":\"2026-07-04T02:21:29-07:00\",\"inLanguage\":\"en-US\",\"commentCount\":3,\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-osx-crisis-variant-invokes-pope-francis\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-osx-crisis-variant-invokes-pope-francis\\\/#webpage\"},\"articleSection\":\"Malware, Security News, Hacking Team, Malware, OSX\\\/Crisis, OSX\\\/Crisis.C, RCS, aabbati\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-osx-crisis-variant-invokes-pope-francis\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/category\\\/security-news\\\/#listItem\",\"name\":\"Security News\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/category\\\/security-news\\\/#listItem\",\"position\":2,\"name\":\"Security News\",\"item\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/category\\\/security-news\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-osx-crisis-variant-invokes-pope-francis\\\/#listItem\",\"name\":\"New OSX\\\/Crisis Variant Invokes Pope Francis\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-osx-crisis-variant-invokes-pope-francis\\\/#listItem\",\"position\":3,\"name\":\"New OSX\\\/Crisis Variant Invokes Pope Francis\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/category\\\/security-news\\\/#listItem\",\"name\":\"Security News\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#organization\",\"name\":\"The Mac Security Blog\",\"description\":\"Keep Macs safe from the dangers of the Internet\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/logo2.png\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-osx-crisis-variant-invokes-pope-francis\\\/#organizationLogo\",\"width\":122,\"height\":46},\"image\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-osx-crisis-variant-invokes-pope-francis\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/integogroup\\\/\",\"https:\\\/\\\/x.com\\\/IntegoSecurity\",\"https:\\\/\\\/www.instagram.com\\\/intego_security\\\/\",\"https:\\\/\\\/www.youtube.com\\\/user\\\/IntegoVideo\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/intego\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/author\\\/aabbati\\\/#author\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/author\\\/aabbati\\\/\",\"name\":\"Arnaud Abbati\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-osx-crisis-variant-invokes-pope-francis\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/0900d8690b71f7469d2052482f01e87f9d1595d251a363d3c8f183fbe91417f8?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"Arnaud Abbati\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-osx-crisis-variant-invokes-pope-francis\\\/#webpage\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-osx-crisis-variant-invokes-pope-francis\\\/\",\"name\":\"New OSX\\\/Crisis Variant Invokes Pope Francis\",\"description\":\"A new sample of OSX\\\/Crisis, the too popular Da Vinci rootkit from Hacking Team, reached our Malware Lab during the weekend. We currently do not have information about the origin of the file on VirusTotal, named \\\"Frantisek,\\\" but it is an Eastern European first name meaning Francis. Could it be related to Pope Francis? Like the previous variants, OSX\\\/Crisis.C is\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-osx-crisis-variant-invokes-pope-francis\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/author\\\/aabbati\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/author\\\/aabbati\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/wp-content\\\/uploads\\\/2012\\\/12\\\/MalwareAlert.png\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-osx-crisis-variant-invokes-pope-francis\\\/#mainImage\",\"width\":400,\"height\":260},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-osx-crisis-variant-invokes-pope-francis\\\/#mainImage\"},\"datePublished\":\"2014-01-20T14:58:15-08:00\",\"dateModified\":\"2026-07-04T02:21:29-07:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#website\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/\",\"name\":\"The Mac Security Blog\",\"description\":\"Keep Macs safe from the dangers of the Internet\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>New OSX\/Crisis Variant Invokes Pope Francis<\/title>\n\n","aioseo_head_json":{"title":"New OSX\/Crisis Variant Invokes Pope Francis","description":"A new sample of OSX\/Crisis, the too popular Da Vinci rootkit from Hacking Team, reached our Malware Lab during the weekend. We currently do not have information about the origin of the file on VirusTotal, named \"Frantisek,\" but it is an Eastern European first name meaning Francis. Could it be related to Pope Francis? Like the previous variants, OSX\/Crisis.C is","canonical_url":"https:\/\/www.intego.com\/mac-security-blog\/new-osx-crisis-variant-invokes-pope-francis\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-osx-crisis-variant-invokes-pope-francis\/#blogposting","name":"New OSX\/Crisis Variant Invokes Pope Francis","headline":"New OSX\/Crisis Variant Invokes Pope Francis","author":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/author\/aabbati\/#author"},"publisher":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2012\/12\/MalwareAlert.png","width":400,"height":260},"datePublished":"2014-01-20T14:58:15-08:00","dateModified":"2026-07-04T02:21:29-07:00","inLanguage":"en-US","commentCount":3,"mainEntityOfPage":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/new-osx-crisis-variant-invokes-pope-francis\/#webpage"},"isPartOf":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/new-osx-crisis-variant-invokes-pope-francis\/#webpage"},"articleSection":"Malware, Security News, Hacking Team, Malware, OSX\/Crisis, OSX\/Crisis.C, RCS, aabbati"},{"@type":"BreadcrumbList","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-osx-crisis-variant-invokes-pope-francis\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.intego.com\/mac-security-blog#listItem","position":1,"name":"Home","item":"https:\/\/www.intego.com\/mac-security-blog","nextItem":{"@type":"ListItem","@id":"https:\/\/www.intego.com\/mac-security-blog\/category\/security-news\/#listItem","name":"Security News"}},{"@type":"ListItem","@id":"https:\/\/www.intego.com\/mac-security-blog\/category\/security-news\/#listItem","position":2,"name":"Security News","item":"https:\/\/www.intego.com\/mac-security-blog\/category\/security-news\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-osx-crisis-variant-invokes-pope-francis\/#listItem","name":"New OSX\/Crisis Variant Invokes Pope Francis"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.intego.com\/mac-security-blog#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-osx-crisis-variant-invokes-pope-francis\/#listItem","position":3,"name":"New OSX\/Crisis Variant Invokes Pope Francis","previousItem":{"@type":"ListItem","@id":"https:\/\/www.intego.com\/mac-security-blog\/category\/security-news\/#listItem","name":"Security News"}}]},{"@type":"Organization","@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization","name":"The Mac Security Blog","description":"Keep Macs safe from the dangers of the Internet","url":"https:\/\/www.intego.com\/mac-security-blog\/","logo":{"@type":"ImageObject","url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2026\/08\/logo2.png","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-osx-crisis-variant-invokes-pope-francis\/#organizationLogo","width":122,"height":46},"image":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/new-osx-crisis-variant-invokes-pope-francis\/#organizationLogo"},"sameAs":["https:\/\/www.facebook.com\/integogroup\/","https:\/\/x.com\/IntegoSecurity","https:\/\/www.instagram.com\/intego_security\/","https:\/\/www.youtube.com\/user\/IntegoVideo","https:\/\/www.linkedin.com\/company\/intego"]},{"@type":"Person","@id":"https:\/\/www.intego.com\/mac-security-blog\/author\/aabbati\/#author","url":"https:\/\/www.intego.com\/mac-security-blog\/author\/aabbati\/","name":"Arnaud Abbati","image":{"@type":"ImageObject","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-osx-crisis-variant-invokes-pope-francis\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/0900d8690b71f7469d2052482f01e87f9d1595d251a363d3c8f183fbe91417f8?s=96&d=mm&r=g","width":96,"height":96,"caption":"Arnaud Abbati"}},{"@type":"WebPage","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-osx-crisis-variant-invokes-pope-francis\/#webpage","url":"https:\/\/www.intego.com\/mac-security-blog\/new-osx-crisis-variant-invokes-pope-francis\/","name":"New OSX\/Crisis Variant Invokes Pope Francis","description":"A new sample of OSX\/Crisis, the too popular Da Vinci rootkit from Hacking Team, reached our Malware Lab during the weekend. We currently do not have information about the origin of the file on VirusTotal, named \"Frantisek,\" but it is an Eastern European first name meaning Francis. Could it be related to Pope Francis? Like the previous variants, OSX\/Crisis.C is","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#website"},"breadcrumb":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/new-osx-crisis-variant-invokes-pope-francis\/#breadcrumblist"},"author":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/author\/aabbati\/#author"},"creator":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/author\/aabbati\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2012\/12\/MalwareAlert.png","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-osx-crisis-variant-invokes-pope-francis\/#mainImage","width":400,"height":260},"primaryImageOfPage":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/new-osx-crisis-variant-invokes-pope-francis\/#mainImage"},"datePublished":"2014-01-20T14:58:15-08:00","dateModified":"2026-07-04T02:21:29-07:00"},{"@type":"WebSite","@id":"https:\/\/www.intego.com\/mac-security-blog\/#website","url":"https:\/\/www.intego.com\/mac-security-blog\/","name":"The Mac Security Blog","description":"Keep Macs safe from the dangers of the Internet","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization"}}]},"og:locale":"en_US","og:site_name":"The Mac Security Blog - Keep Macs safe from the dangers of the Internet","og:type":"article","og:title":"New OSX\/Crisis Variant Invokes Pope Francis","og:description":"A new sample of OSX\/Crisis, the too popular Da Vinci rootkit from Hacking Team, reached our Malware Lab during the weekend. We currently do not have information about the origin of the file on VirusTotal, named &quot;Frantisek,&quot; but it is an Eastern European first name meaning Francis. Could it be related to Pope Francis? Like the previous variants, OSX\/Crisis.C is","og:url":"https:\/\/www.intego.com\/mac-security-blog\/new-osx-crisis-variant-invokes-pope-francis\/","article:published_time":"2014-01-20T22:58:15+00:00","article:modified_time":"2026-07-04T09:21:29+00:00","article:publisher":"https:\/\/www.facebook.com\/integogroup\/","twitter:card":"summary_large_image","twitter:site":"@IntegoSecurity","twitter:title":"New OSX\/Crisis Variant Invokes Pope Francis","twitter:description":"A new sample of OSX\/Crisis, the too popular Da Vinci rootkit from Hacking Team, reached our Malware Lab during the weekend. We currently do not have information about the origin of the file on VirusTotal, named &quot;Frantisek,&quot; but it is an Eastern European first name meaning Francis. Could it be related to Pope Francis? Like the previous variants, OSX\/Crisis.C is","twitter:creator":"@IntegoSecurity"},"aioseo_meta_data":{"post_id":"21938","title":null,"description":null,"keywords":null,"keyphrases":null,"focus_keyword":null,"additional_keywords":null,"truseo_locale":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_custom_url":null,"og_image_custom_fields":null,"og_image_url":null,"og_image_width":null,"og_image_height":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_image_url":null,"twitter_title":null,"twitter_description":null,"schema_type":"default","schema_type_options":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"limit_modified_date":false,"ai":null,"breadcrumb_settings":null,"seo_analyzer_scan_date":"2026-09-03 16:50:25","created":"2026-09-03 16:50:25","updated":"2026-09-04 13:27:01","reviewed_by":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/www.intego.com\/mac-security-blog\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/www.intego.com\/mac-security-blog\/category\/security-news\/\" title=\"Security News\">Security News<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\tNew OSX\/Crisis Variant Invokes Pope Francis\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.intego.com\/mac-security-blog"},{"label":"Security News","link":"https:\/\/www.intego.com\/mac-security-blog\/category\/security-news\/"},{"label":"New OSX\/Crisis Variant Invokes Pope Francis","link":"https:\/\/www.intego.com\/mac-security-blog\/new-osx-crisis-variant-invokes-pope-francis\/"}],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/21938","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/users\/29"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/comments?post=21938"}],"version-history":[{"count":69,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/21938\/revisions"}],"predecessor-version":[{"id":105861,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/21938\/revisions\/105861"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/media\/8755"}],"wp:attachment":[{"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/media?parent=21938"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/categories?post=21938"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/tags?post=21938"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}