{"id":2622,"date":"2011-05-02T11:35:21","date_gmt":"2011-05-02T18:35:21","guid":{"rendered":"http:\/\/blog.intego.com\/?p=2622"},"modified":"2026-07-01T13:46:41","modified_gmt":"2026-07-01T20:46:41","slug":"macdefender-rogue-anti-malware-program-attacks-macs-via-seo-poisoning","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/macdefender-rogue-anti-malware-program-attacks-macs-via-seo-poisoning\/","title":{"rendered":"MAC Defender Rogue Anti-Malware Program Attacks Macs via SEO Poisoning"},"content":{"rendered":"

UPDATE: See Intego’s full security memo<\/a> with detailed information about the MAC Defender fake antivirus.<\/p>\n

Intego has discovered a rogue anti-malware program called MACDefender, which attacks Macs via SEO poisoning attacks. When a user clicks on a link after performing a search on a search engine such as Google, this takes them to a web site whose page contains JavaScript that automatically downloads a file. In this case, the file downloaded is a compressed ZIP archive, which, if a specific option in a web browser is checked (Open “safe” files after downloading in Safari, for example), will open. The file is decompressed, and the installer it contains launches presenting a user with the following screen:<\/p>\n

\"\"<\/p>\n

If the user continues through the installation process, and enters an administrator’s password, the software will be installed.<\/p>\n

\"\"<\/p>\n

It is important that users not continue with any unexpected installation of this type. Intego VirusBarrier X6’s<\/a> malware definitions will be updated today, and Intego will be publishing a security memo when we have more information about this malware. For now, the threat is low, but users should be careful not to install software when installers open unexpectedly.<\/p>\n

\n

Protect your Mac from malware<\/h4>\n

Download a free 30-day trial version of VirusBarrier X6 and save $5<\/p>\n

<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Intego has discovered a rogue anti-malware program called MACDefender, which attacks Macs via SEO poisoning attacks.<\/p>\n","protected":false},"author":3,"featured_media":8763,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[190],"tags":[54,2689,86,113],"class_list":["post-2622","post","type-post","status-publish","format-standard","has-post-thumbnail","category-malware","tag-fake-antivirus","tag-macdefender","tag-mac-malware","tag-rogue-antivirus"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t