ITWire

Fake AV scams work by causing web pages to throw up bogus windows asserting that malware has been detected on the computer and that they should be removed. The page then downloads a fake malware protection and cleanup tool, which the victim is asked to pay for so that the (non-existent) malware can be removed.

The MACDefender (aka MAC Defender) fake AV has apparently claimed a number of victims, despite initially presenting itself as a "Windows Security Alert". Whichever button the user clicks, a malicious download is triggered. Sometimes it is a ready to run application, sometimes it is an installer.

According to security software vendor Sophos, the fake scanner also redirects the web browser to porn sites, perhaps in an attempt to give credence to its claim that the Mac is infected.

Apart from that, there are no current indications that the software has any sinister purpose other than to trick people into paying for a program that doesn't do what it claims.

Intego, another security vendor, says MACDefender is being propagated through SEO poisoning, which causes malicious sites to appear at the top of various search results.

CONTINUED