To make matters worse, the malware is digitally signed with a valid Apple developer certificate. Intego says that certificate was issued to a “Maksim Noskov.” According to Johannes Ullrich, Ph.D., of the SANS Institute's Internet Storm Center, the security researcher who first spotted the malware, Apple has since revoked that certificate.
Don’t miss the best of The Mac Observer
Set us as a preferred source and our Apple reporting ranks higher in your Google Search results and Discover feed — one tap, no account changes.
Mr. Ullrich posted a video of the malware that he installs on a fresh system so we can see what it does:
Discussion