Even though the Mac can by no means be considered a paradise of viruses and security threats, even on it a threat appears from time to time. The same is the case today, when the Russian server Doctor Web discovered a new adware for computers on the Internet Applu, which automatically installs its copy in the three most popular and used browsers on the platform – Safari, Chrome, Firefox. The threat is called Trojan.Yontoo.1, and this plug-in is capable of displaying and embedding ads on any site, including the company's official site Apple.
However, the new threat is not very intelligent and currently requires the user to install it on their Mac themselves, which can only be achieved by visiting trusted video sites. This is, for example, clicking on suspicious links to Facebooku or anywhere on the Internet, while these pages require you to install a browser plugin, an additional media player, a program to increase the image quality of videos or a utility to speed up downloads. After installing this virus, the browser will automatically start sending the details of the websites you visit to the hackers' servers, which will then evaluate a suitable location to insert fake ads, such as in the image below:
Final advice? Never install add-ons from unofficial sites, or sites you got to, for example, by clicking on links to Facebooku, for example, to those that promise a pornographic video with Steven Seagal in the lead role.
Well, this advertising banner was also displayed to me and I suspected amazon plugin. I use it exclusively Safari, Chrome and FF only for web tests apps.
The mentioned banner was displayed only in Safari and the plugins I use are from Amazon, AdBlock, 1Pass and Evernote. After uninstalling the Evernote plugin and clearing the cache, the ad stopped appearing.
I am currently contacting Evernote with the fact that I reinstalled the plugin at the time when they announced that it was necessary to change the password due to a possible intrusion into their network and I am asking for details on whether their plugin could have been replaced.