Ok, so maybe crime DOES pay…
Per Symantec’s company blog, the malware known as “Flashback” that was believed to have infected hundreds of thousands of Macs may have paid out as much as US$10,000 a day to its authors.
The estimate comes from Symantec, which said in a post to its official blog that the primary motivation behind the malware was money. The Flashback Trojan includes an ad-clicking component that will load itself into the three major browsers for Mac — Safari, Firefox and Chrome — and generate revenue for the attackers.
“Flashback specifically targets queries made on Google and, depending on the search query, may redirect users to another page of the attacker’s choosing, where they receive revenue from the click,” Symantec explained.
Peering into the Trojan’s code, the security firm found a redirected URL that generates the authors of the code 8 cents per click. If a user conducts a Google search, Flashback will “hijack” the ad click from Google, taking money away from the search giant and granting “untold sums” to the authors of the Trojan.
A previous analysis of a different Trojan found that a botnet with just 25,000 infections could generate up to US$450 per day. At its peak, the Flashback Trojan was estimated to have infected 600,000 Macs worldwide, which means the authors could have earned as much as US$10,000 per day.
The presence of Flashback has greatly diminished since Apple released a series of software updates last month aimed at squashing the malware, including a Java update and a separate removal tool.
The Flashback Trojan was first discovered by another security firm, Intego, last September. The software attempts to trick users into installing it by appearing as Adobe’s Flash Player installer package.
Stay tuned for additional details as they become available and if you haven’t downloaded and installed Apple’s anti-flashback removal tool via Mac OS X’s Software Update feature, there’s no time like the present.