Spyware:​OSX/OpinionSpy

Threat description

Details

CATEGORYMalware
TYPESpyware

Summary

This program negatively affects a user's control of their computer system or browsing experience, usually without their consent or knowledge.

Removal

Allow F-Secure Anti-Virus for Mac to remove the relevant files.

Technical Details

Spyware:OSX/OpinionSpy affects computers running the Mac operating system and silently monitors the user's activities. Information about the user's actions may also be forwarded to a remote server.

The details below refer to the original Spyware:OSX/OpinionSpy.A variant; a later B variant is also known.

This malware was discussed in the Lab Weblog in this blogpost.

Distribution

OpinionSpy is a standalone application that may be distributed together with and/or installed by other Mac applications available online. These 'delivery programs' retrieve the OpinionSpy program and install it during their own installation.

Deceptive notifications or messages may be displayed during the installation process to mislead the user into believing the second installed program is a 'market research' program.

Activity

Once installed on the system, OpinionSpy can:

  • Open a HTTP backdoor
  • Scan and analyze all accessible files
  • Scan and analyze transmitted network data
  • Send encrypted data to a remote server

Submit a Sample

Suspect a file or URL was wrongly detected?
Send it to our Labs for further analysis

Submit a Sample

Disinfect your Mac

F-Secure Anti-Virus for Mac will disinfect your Mac and remove all harmful files

More Info