{"id":2777,"date":"2011-05-19T10:32:03","date_gmt":"2011-05-19T17:32:03","guid":{"rendered":"http:\/\/blog.intego.com\/?p=2777"},"modified":"2026-07-01T04:16:05","modified_gmt":"2026-07-01T11:16:05","slug":"blackhole-rat-evolves-again-new-variant-found","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/blackhole-rat-evolves-again-new-variant-found\/","title":{"rendered":"BlackHole RAT Evolves Again: New Variant Found"},"content":{"rendered":"

Intego has discovered a new variant of the BlackHole RAT which we discussed in February<\/a>. While the main principles of the tool – a remote administration tool – remain the same, it includes a backdoor, called Server.app, and a keylogger, called KeyLogger.app. It also adds these two latter elements to a user’s Login Items. The full toolkit is installed in a folder named .JavaUpdater; this folder is normally invisible, at least in the Finder, as are all items whose names begin with a period. <\/p>\n

The RAT also installs a video capture tool, available from a “normal” website – ie., not a hacker module – which can be eventually used to capture video from an iSight camera. All of these modules are written in RealBasic, a portable, cross-platform language that creates executables using a runtime. <\/p>\n

\"\"<\/p>\n

For now, the risk is still very low. Malicious users need access to Macs to install this software, either by physically accessing a Mac, or by accessing it over a network. It is recommended to use a firewall, to prevent such network attacks, such as that found in Intego VirusBarrier X6<\/a>. <\/p>\n

\n

Protect your Mac from malware<\/a><\/h4>\n
<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Intego has discovered a new variant of the BlackHole RAT, a remote administration tool that can affect Macs. The risk is still low.<\/p>\n","protected":false},"author":3,"featured_media":2784,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[190],"tags":[2719,62,86],"class_list":["post-2777","post","type-post","status-publish","format-standard","has-post-thumbnail","category-malware","tag-blackhole-rat","tag-hacker-tool","tag-mac-malware"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t