Intego said that malware authors have spammed Mac forums with links for pornographic websites hosting the malware.
Users attempting to install the codec receive a piece of malware classified as a 'DNS Changer' which modifies the way OS X handles the DNS requests used to link numerical IP addresses to web URLs.
The tool allows the attackers to redirect web traffic. Users attempting to visit PayPal, eBay or certain banking sites, for instance, will be directed to a phishing website instead.
If confirmed, the Trojan would be the first piece of truly malicious software to be targeted at OS X.
Researchers have previously developed OS X attacks and exploits, but these were largely proof-of-concept attacks that lacked a malicious payload.
While security experts agree that such malware would pose a very serious threat to Mac users, it remains unclear just how far the reported Trojan has spread.
Early on Wednesday morning, representatives for McAfee, Symantec and Trend Micro said that their researchers had been unable to find the Trojan in the wild or obtain a sample from Intego.
A spokesperson for Symantec suggested that Intego "has a tendency to over-hype things".
UPDATE: McAfee has confirmed the existence of the OSX.RSPlug.A Trojan and reported that it is spreading through fake codec sites in addition to the porn website.
.jpg&h=140&w=231&c=1&s=0)
iTnews State of Security Breakfast
iTnews State of Data & AI Breakfast
The 2026 iAwards
.jpg&w=120&c=1&s=0)
Integrate 2026
Security Exhibition & Conference
_(1).jpg&h=140&w=231&c=1&s=0)
