He cautioned that those are just the infected systems he found, and that the total could be in the low thousands. ' hacker built this to spy on users for probably perverse reasons,' explained Wardle, emphasizing that it was 'designed to performance surveillance.'Īpproximately 90 percent of the infected computers are located in the U.S., with Wardle identifying around 400 compromised devices. Instead, it appeared to have a completely different objective. Strangely, however, the system didn't seem designed for financial gain as is more typical of malware infecting the devices of everyday folks. 'Usually you see that in government or nation-state software,' Wardle, who used to work for the NSA, observed.īut the victims weren't nation-state actors - they were regular people. (opens in a new tab) (Opens in a new tab) The malware gave him the power to remotely switch on webcams and microphones, take control of mice, change files, and would even notify him if the computer was in use by its owner. So, for starters, Wardle was sitting on the names and locations of many of the victims. With most Macs, the computer name is just the owner's name. What he found, well, is pretty damn creepy.įirst, Fruitfly gave him both the infected computers' IP addresses - which can be used to determine their locations - and the computers' names. So he registered one, and created a server that could talk to the malware. It just so happened that 'one or two' of those domains were available for registration.

As such, he realized the computers would look for specific backup domains for their directions. Wardle discovered that the malware directed infected computers to contact a command and control server for instructions - known as 'tasking' - but that the primary server was offline.

That investigation led to some unexpected places. In a conversation with Mashable, Wardle explained that he was sent the malicious software by a friend earlier this year, and that he found it interesting enough to investigate. ' hacker built this to spy on users for probably perverse reasons.' However, it was Synack Chief Security Researcher Patrick Wardle (Opens in a new tab) who blew the lid off Fruitfly's true nature on July 21. The malware, dubbed Fruitfly, was first reported on in January by Malwarebytes (Opens in a new tab). Remotely hacking ships shouldn't be this easy, and yet.

Spyware on mac