Never judge an app by its cover.
A malicious app has been masquerading as a benign online document converter, researchers at the cybersecurity firm Bitdefender warned Wednesday. The application claims to convert certain file types into Microsoft (MSFT) Word versions, simply and freely.
In fact, the app sabotages people’s computers, the researchers said. Called “EasyDoc Converter,” the fake application is designed to sucker people into installing it, giving attackers full anonymous access to infected Apple (AAPL) machines.
Get Data Sheet, Coins2Day’s technology newsletter.
“It’s not your typical type of malware,” Alexandra Gheorghe, security specialist at Bitdefender, told Coins2Day. “ You install it, but you as an individual have no idea that it’s running in the background and it extracts information regarding everything you do on your system.”
“It’s very silent,” she added.
The Mac malware creates what’s known as a backdoor on Apple operating systems OS X 10.6 (aka Snow Leopard) or later. This enables attackers to take full control of a computer, including its webcam, files, email service, and execute code commands, the researchers said in a blog post.
The malware also helps establish a connection over the Tor network, a computer network that lets the hackers remain anonymous.
The good news is that the malware, dubbed “Backdoor.MAC.Eleanor” by the researchers, is not available in Apple’s (AAPL) official App Store. Instead, the app has been advertised for download on third-party sites; for instance, a copy was available on the site MacUpdate until it was removed on Tuesday.
Apple’s default “Gatekeeper” security feature generates a pop up alert when people try to download and install the fake app. But users could still choose to ignore the warning.
Gheorghe said the Bitdefender team has identified a suspect who might behind the scam—a person who has openly expressed interest on social media about creating Mac backdoors—but she declined to reveal any further information, saying that “we would like to verify further and investigate further if our suspicions are right.”
Bitdefender said it could not determine how many people’s computers are infected with the malware.
For more on Mac malware, watch:
Attackers have historically targeted Apple devices with malware less frequently than they have targeted other PC-makers, partly due to the latter’s traditionally larger market share. Earlier this year, another piece of Mac malware came to light called KeRanger ransomware, which encrypted the contents of Apple computers and held the data for ransom.
As a general practice, computer security experts recommend that people download software only from trusted sources over trusted network connections. For those who may have already been infected, the cybersecurity software firm Malwarebytes has incorporated a removal tool into its free anti-malware software.
Other proactive security tools that protect against malware include BlockBlock, an anti-malware app that flags possible security breaches in PCs, as well as Little Snitch, a tool that tells you who your computer is talking to.
Of course, it’s easiest just to avoid downloading fishy apps altogether.