{"id":930,"date":"2009-06-19T13:18:27","date_gmt":"2009-06-19T12:18:27","guid":{"rendered":"http:\/\/blog.intego.com\/?p=930"},"modified":"2009-06-19T13:18:27","modified_gmt":"2009-06-19T12:18:27","slug":"new-rsplug-trojan-horse-variant-found-on-game-sites","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/new-rsplug-trojan-horse-variant-found-on-game-sites\/","title":{"rendered":"New RSPlug Trojan Horse Variant Found on Game Sites"},"content":{"rendered":"<p>Intego&#8217;s Virus Monitoring Center has found a new variant of the RSPlug Trojan horse, the first one in more than a month, which we are calling OSX\/RSPLug.K. The differences between this and previous versions of the RSPlug Trojan are minor, but there&#8217;s a major new twist. This new variant has been spotted on sites offering game downloads. <\/p>\n<p>Previous versions have mostly been found on porn and warez (pirated software) sites, leading some commentators to say that only users involved in illegal activities are likely to get infected. (We&#8217;ll skip the argument about whether or not pornography is illegal&#8230;) This time, however, users going to web sites that provide game downloads end up downloading an installer that gives them a serious Trojan horse. While some of these games are intended to be pirated copies of low-priced commercial games, others are often found on web sites for free for on-line play.<\/p>\n<p><center><br \/>\n<img decoding=\"async\" src=\"https:\/\/www.intego.com\/mac-security-blog\/images\/games1.jpg\"><br \/>\n<\/center><\/p>\n<p>Clicking a link to go to a game takes the visitor to a page with a download link:<\/p>\n<p><center><br \/>\n<img decoding=\"async\" src=\"https:\/\/www.intego.com\/mac-security-blog\/images\/games2.jpg\"><br \/>\n<\/center><\/p>\n<p>This leads to a download of a disk image whose name contains the name of the game downloaded:<\/p>\n<p><center><br \/>\n<img decoding=\"async\" src=\"https:\/\/www.intego.com\/mac-security-blog\/images\/games3.jpg\"><br \/>\n<\/center><\/p>\n<p><a href=\"https:\/\/www.intego.com\/virusbarrier\/\">Intego VirusBarrier X5<\/a>, with the current virus definitions, spotted this variant right away; our proactive analysis allows us to spot a number of characteristics of this Trojan horse easily.<\/p>\n<p><center><br \/>\n<img decoding=\"async\" src=\"https:\/\/www.intego.com\/mac-security-blog\/images\/games4.png\"><br \/>\n<\/center><\/p>\n<p>Note that Intego has also spotted this variant on some MP3 blogs, sites that provide pirated music for download; or at least claim to. They actually provide Trojan horses saying they are download utilities. We recommend that Mac users download software only from trusted sites. The spread of this Trojan horse is such that more and more sites will be providing it instead of real software, and it may become increasingly easy to get fooled.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Intego&#8217;s Virus Monitoring Center has found a new variant of the RSPlug Trojan horse, the first one in more than a month, which we are calling OSX\/RSPLug.K. The differences between this and previous versions of the RSPlug Trojan are minor, but there&#8217;s a major new twist. This new variant has been spotted on sites offering [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13],"tags":[],"class_list":["post-930","post","type-post","status-publish","format-standard","category-security-privacy"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>New RSPlug Trojan Horse Variant Found on Game Sites  - The Mac Security Blog<\/title>\n<meta name=\"description\" content=\"Intego&#039;s Virus Monitoring Center has found a new variant of the RSPlug Trojan horse, the first one in more than a month, which we are calling\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.intego.com\/mac-security-blog\/new-rsplug-trojan-horse-variant-found-on-game-sites\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"New RSPlug Trojan Horse Variant Found on Game Sites  - The Mac Security Blog\" \/>\n<meta property=\"og:description\" content=\"Intego&#039;s Virus Monitoring Center has found a new variant of the RSPlug Trojan horse, the first one in more than a month, which we are calling\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.intego.com\/mac-security-blog\/new-rsplug-trojan-horse-variant-found-on-game-sites\/\" \/>\n<meta property=\"og:site_name\" content=\"The Mac Security Blog\" \/>\n<meta property=\"article:published_time\" content=\"2009-06-19T12:18:27+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.intego.com\/mac-security-blog\/images\/games1.jpg\" \/>\n<meta name=\"author\" content=\"Peter James\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Peter James\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-rsplug-trojan-horse-variant-found-on-game-sites\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-rsplug-trojan-horse-variant-found-on-game-sites\\\/\"},\"author\":{\"name\":\"Peter James\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#\\\/schema\\\/person\\\/d0c16bd0a4dd8f82d91204f400c8d116\"},\"headline\":\"New RSPlug Trojan Horse Variant Found on Game Sites\",\"datePublished\":\"2009-06-19T12:18:27+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-rsplug-trojan-horse-variant-found-on-game-sites\\\/\"},\"wordCount\":303,\"publisher\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-rsplug-trojan-horse-variant-found-on-game-sites\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/images\\\/games1.jpg\",\"articleSection\":[\"Security &amp; Privacy\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-rsplug-trojan-horse-variant-found-on-game-sites\\\/\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-rsplug-trojan-horse-variant-found-on-game-sites\\\/\",\"name\":\"New RSPlug Trojan Horse Variant Found on Game Sites - The Mac Security Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-rsplug-trojan-horse-variant-found-on-game-sites\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-rsplug-trojan-horse-variant-found-on-game-sites\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/images\\\/games1.jpg\",\"datePublished\":\"2009-06-19T12:18:27+00:00\",\"description\":\"Intego's Virus Monitoring Center has found a new variant of the RSPlug Trojan horse, the first one in more than a month, which we are calling\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-rsplug-trojan-horse-variant-found-on-game-sites\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-rsplug-trojan-horse-variant-found-on-game-sites\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-rsplug-trojan-horse-variant-found-on-game-sites\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/images\\\/games1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/images\\\/games1.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-rsplug-trojan-horse-variant-found-on-game-sites\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"New RSPlug Trojan Horse Variant Found on Game Sites\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#website\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/\",\"name\":\"The Mac Security Blog\",\"description\":\"Keep Macs safe from the dangers of the Internet\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#organization\",\"name\":\"Intego\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/wp-content\\\/uploads\\\/2022\\\/10\\\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png\",\"contentUrl\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/wp-content\\\/uploads\\\/2022\\\/10\\\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png\",\"width\":875,\"height\":875,\"caption\":\"Intego\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#\\\/schema\\\/person\\\/d0c16bd0a4dd8f82d91204f400c8d116\",\"name\":\"Peter James\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/02040a1b56c0554236733a69e59ffeacde3aff8b1d8fb9818a2b71ebbc0e2484?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/02040a1b56c0554236733a69e59ffeacde3aff8b1d8fb9818a2b71ebbc0e2484?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/02040a1b56c0554236733a69e59ffeacde3aff8b1d8fb9818a2b71ebbc0e2484?s=96&d=mm&r=g\",\"caption\":\"Peter James\"},\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/author\\\/peter\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"New RSPlug Trojan Horse Variant Found on Game Sites  - The Mac Security Blog","description":"Intego's Virus Monitoring Center has found a new variant of the RSPlug Trojan horse, the first one in more than a month, which we are calling","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.intego.com\/mac-security-blog\/new-rsplug-trojan-horse-variant-found-on-game-sites\/","og_locale":"en_US","og_type":"article","og_title":"New RSPlug Trojan Horse Variant Found on Game Sites  - The Mac Security Blog","og_description":"Intego's Virus Monitoring Center has found a new variant of the RSPlug Trojan horse, the first one in more than a month, which we are calling","og_url":"https:\/\/www.intego.com\/mac-security-blog\/new-rsplug-trojan-horse-variant-found-on-game-sites\/","og_site_name":"The Mac Security Blog","article_published_time":"2009-06-19T12:18:27+00:00","og_image":[{"url":"https:\/\/www.intego.com\/mac-security-blog\/images\/games1.jpg","type":"","width":"","height":""}],"author":"Peter James","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Peter James","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-rsplug-trojan-horse-variant-found-on-game-sites\/#article","isPartOf":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/new-rsplug-trojan-horse-variant-found-on-game-sites\/"},"author":{"name":"Peter James","@id":"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/d0c16bd0a4dd8f82d91204f400c8d116"},"headline":"New RSPlug Trojan Horse Variant Found on Game Sites","datePublished":"2009-06-19T12:18:27+00:00","mainEntityOfPage":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/new-rsplug-trojan-horse-variant-found-on-game-sites\/"},"wordCount":303,"publisher":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization"},"image":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/new-rsplug-trojan-horse-variant-found-on-game-sites\/#primaryimage"},"thumbnailUrl":"https:\/\/www.intego.com\/mac-security-blog\/images\/games1.jpg","articleSection":["Security &amp; Privacy"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-rsplug-trojan-horse-variant-found-on-game-sites\/","url":"https:\/\/www.intego.com\/mac-security-blog\/new-rsplug-trojan-horse-variant-found-on-game-sites\/","name":"New RSPlug Trojan Horse Variant Found on Game Sites - The Mac Security Blog","isPartOf":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/new-rsplug-trojan-horse-variant-found-on-game-sites\/#primaryimage"},"image":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/new-rsplug-trojan-horse-variant-found-on-game-sites\/#primaryimage"},"thumbnailUrl":"https:\/\/www.intego.com\/mac-security-blog\/images\/games1.jpg","datePublished":"2009-06-19T12:18:27+00:00","description":"Intego's Virus Monitoring Center has found a new variant of the RSPlug Trojan horse, the first one in more than a month, which we are calling","breadcrumb":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/new-rsplug-trojan-horse-variant-found-on-game-sites\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.intego.com\/mac-security-blog\/new-rsplug-trojan-horse-variant-found-on-game-sites\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-rsplug-trojan-horse-variant-found-on-game-sites\/#primaryimage","url":"https:\/\/www.intego.com\/mac-security-blog\/images\/games1.jpg","contentUrl":"https:\/\/www.intego.com\/mac-security-blog\/images\/games1.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-rsplug-trojan-horse-variant-found-on-game-sites\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.intego.com\/mac-security-blog\/"},{"@type":"ListItem","position":2,"name":"New RSPlug Trojan Horse Variant Found on Game Sites"}]},{"@type":"WebSite","@id":"https:\/\/www.intego.com\/mac-security-blog\/#website","url":"https:\/\/www.intego.com\/mac-security-blog\/","name":"The Mac Security Blog","description":"Keep Macs safe from the dangers of the Internet","publisher":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.intego.com\/mac-security-blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization","name":"Intego","url":"https:\/\/www.intego.com\/mac-security-blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png","contentUrl":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png","width":875,"height":875,"caption":"Intego"},"image":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/d0c16bd0a4dd8f82d91204f400c8d116","name":"Peter James","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/02040a1b56c0554236733a69e59ffeacde3aff8b1d8fb9818a2b71ebbc0e2484?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/02040a1b56c0554236733a69e59ffeacde3aff8b1d8fb9818a2b71ebbc0e2484?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/02040a1b56c0554236733a69e59ffeacde3aff8b1d8fb9818a2b71ebbc0e2484?s=96&d=mm&r=g","caption":"Peter James"},"url":"https:\/\/www.intego.com\/mac-security-blog\/author\/peter\/"}]}},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/930","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/comments?post=930"}],"version-history":[{"count":0,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/930\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/media?parent=930"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/categories?post=930"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/tags?post=930"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}