Web Exploit Customizes Trojan Payload for Different OS

[rrplay]

*** Really best to be absolutely diligent no matter which OS system is being run.

Web exploit figures out what OS victim is using, customizes payload
Different versions of trojan infect machines running OS X, Windows, or Linux.

Malicious code inside this Java file loads a different trojan depending on the operating system used by the target.F-Secure

"Security researchers have found a live Web exploit that detects if the target is running Windows, Mac OS X, or Linux and drops a different trojan for each platform.

The attack was spotted by researchers from antivirus provider F-Secure on a Columbian transport website, presumably after third-party attackers compromised it. The unidentified site then displayed a signed Java applet that checked if the user's computer is running Windows, Mac OS X, or Linux. Based on the outcome, the attack then [url=Security researchers have found a live Web exploit that detects if the target is running Windows, Mac OS X, or Linux and drops a different trojan for each platform.

The attack was spotted by researchers from antivirus provider F-Secure on a Columbian transport website, presumably after third-party attackers compromised it. The unidentified site then displayed a signed Java applet that checked if the user's computer is running Windows, Mac OS X, or Linux. Based on the outcome, the attack then downloads the appropriate files for each platform..."

[rrplay]

no doubt that this will likely affect more users than the Dns Changer reported earlier
viewtopic.php?f=12&t=293

[funkindrago]

Them there malware writers certainly are getting trickier. It was only a matter of time before something like this came out. Hence Apple changing their wording about being a secure choice...

[rrplay]

Them there malware writers certainly are getting trickier. It was only a matter of time before something like this came out. Hence Apple changing their wording about being a secure choice...

yep ! and what's notable is that BSDs and variants are left out of the mix for now.
surprised no one else noticed ... oh well