ITWire

Dubbed Sabpab by security vendor Sophos, a new piece of malware can find its way onto a Mac with no user intervention other than visiting a malicious web page. This is achieved by exploiting a vulnerability in Java that was patched in the update released last week by Apple following the outbreak of the Flashback.K malware.

So if you applied the Java update promptly, there's most likely nothing here for you to worry about.

Sabpab (which apparently gets its name from its use of a file called com.apple.PubSabAgent.pfile, a similar name to the legitimate com.Apple.PubSubAgent.plist) sets up a backdoor on infected Macs.

"It connects to a control server using HTTP, receiving commands from remote hackers as to what it should do. The criminals behind the attack can grab screenshots from infected Macs, upload and download files, and execute commands remotely," said Graham Cluley, senior technology consultant, Sophos.

Sabpab is detected by security products from Sophos, Symantec and (presumably) other vendors.

It is easily removed manually by deleting /Users//Library/Preferences/com.apple.PubSabAgent.pfile and /Users//Library/LaunchAgents/com.apple.PubSabAGent.plist. If you haven't applied last week's Java update, the risk of re-infection will remain.