A researcher has discovered a strain of malware in the wild that targets macOS users, reports ZDNet. The malware, dubbed MaMi, was first spotted by security researcher Patrick Wardle.
![](/wp-content/uploads/archive/4C754FC5-6BB1-4648-856E-B8B3BDFE7C2B.jpeg)
![](/wp-content/uploads/archive/4C754FC5-6BB1-4648-856E-B8B3BDFE7C2B.jpeg)
The researcher spotted a forum post on Malwarebytes in which a user said a colleague “accidentally installed something” and this led to DNS hijacking. Despite the user removing the DNS entries, the address changes, 82.163.143.172 and 82.163.142.174, remained persistent.
In a blog post, Wardle said that while infection methods remain a mystery, the malware is hosted on a number of domains. The researcher found it to be a “trivial” affair to decrypt the malware’s configuration data and discovered MaMi also installs a certificate through the Keychain Access app, which would allow for Man-in-The-Middle attacks (MiTM).