A Trojan targeting Mac computers is hijacking victims' computing power to generate Bitcoins, a form of digital currency used in underground cybercrime markets. The malware creators may have also rigged the Trojan to go after those who use Bitcoins, including people who store and share child pornography on their computers.
The Trojan, identified as "DevilRobber" by the anti-virus maker Sophos, comes hidden in bootleg copies of GraphicConverter version 7.4, a Mac image-editing application. The bootleg copies are found on file-sharing websites such as The PirateBay. Once the bootlegs are installedDevilRobber sneaks onto systems and attempts to generate Bitcoins by stealing infected computers' Graphic Processing Unit (GPU) time.
GPUs are "much better than regular CPUs at performing the mathematical calculations required for Bitcoin mining," Sophos' Graham Cluley wrote in a company blog.
Along with creating Bitcoins, DevilRobber steals usernames and passwords and takes screen grabs and Safari Web browsing history from affected computers. But, unlike most Trojans and other malware, DevilRobber appears to have a social agenda — to expose the child pornography traders who often purchase their illegal files with Bitcoins.
[Anonymous Hackers Take Down Child Porn Websites, Leak Users' Names]
Cluley explains that the Trojan hunts for any files that match "pthc." Based on this code, an Internet acronym for "pre-teen hardcore pornography," it's possible DevilRobber was built to put pressure on child pornography traders to stop. If it finds Bitcoins on a system, DevilRobber steals them.
To keep your computer from becoming infected by DevilRobber, don't download pirated material from file-sharing sites. The content shared and traded on these sites can easily be rigged with malware.