Security Response

It seems there is no let up in the recent spate of Mac malware. A few days ago, another group of domains were registered and are being used to support a fake antivirus campaign that not only targets Mac, but also Windows users.

A series of sites were all registered by a Lee Juango who gives an address in "Pekin". However, the Web sites are hosted in Romania. The interesting thing is that these sites look almost exactly the same, with slight text changes depending on if the target is a Mac or a PC.

On the Mac domains, you will get a file called "macprotector.zip" (MacProtector). On the page for Windows, you get a file named “install.exe” (detected as Trojan.Gen/Trojan.FakeAV!gen39). This is actually a copy of...

Over the last few years, Symantec has observed a substantial rise in the use of exploit kits. There are several kits that have come and gone, but a few of them have survived the competition—Neosploit being among them. This blog will discuss the Neosploit toolkit's specific functionality of employing JAR files to deliver malicious files.

Neosploit was first seen by Symantec in March 2007. Since then, the kit has evolved to be one of the "finest" exploit kits to date. Malicious users have never stopped using this kit, despite the fact that there is news that this infamous toolkit’s development has been shut down....