The first fake AV targeting Macs makes false claims that the machine is heavily infected. (Image: Intego Security.)
"FYI, my daughter said the program started after clicking on a 'hair style photo,'" added "Mr. Fix It Home Services" on the same support thread. Others reported stumbling upon MAC Defender after searching for images of prom tuxedos or for pictures of a character in the movie "Princess Bride."
On Monday, Intego published a detailed advisory about MAC Defender, noting that that it was "very well designed, and looks professional."
Intego spotted MAC Defender and acquired samples on Saturday, said James, who pointed out that users must enter their administrative password to install the program. "So there's still a social engineering angle here," he said.
In fact, users see a generic Windows-oriented page when they first click a link to the rogueware. "They're not even getting a Mac-specific page," James said.
But unless users have Safari set not to automatically open files after downloading, MAC Defender's installation screen opens without any user action. That's been enough to con some into approving the install by typing their administrative password.
The program also relies on an unusual technique to make users pay up.
"Every few minutes, it opens a porn page in the browser," said James of MAC Defender. "We think they're doing this because most people will assume that that means they've got a virus on their Mac, and they need to get rid of it by paying for the program."
MAC Defender demands $60-$80, depending on whether users select a one-year, two-year or lifetime "license."
Ironically, there are only eight to 10 serial numbers that MAC Defender accepts, said James, and those are tucked into the binary file -- unencrypted -- where advanced users may be able to root them out.
James also called out the MAC Defender's look and feel as an indicator that the criminals are serious about reaping profits from Mac users. "This was done by a very sophisticated Mac interface developer," James said. "It's an obvious sign that [scammers] are starting to target Macs. Earlier [scams], such as 2008's MacSweeper just didn't bother trying to look professional."
Intego spotted MacSweeper, a fake Macintosh system cleaning program, in January 2008.
MAC Defender has also created some collateral damage: The rogueware uses the same name as a legitimate German company that develops Mac software.