3

I was browsing a finance site when I got an alert from my third-party antivirus, now this was NOT a popup on the webpage (fake tech support) or a recommendation via MacOS. My antivirus had actually detected and quarantined 2 malicious JavaScript files within Safari’s cache, they were categorised as ‘Trojan.gen’. I ran Malwarebytes which also detected the same 2 files. I deleted the files, re-run the scans and everything came back clear.

XProtect didn’t alert me to any problems.

I thought these might have been false positives but decided to run the URL through VirusTotal. Unfortunately 42 security vendors analysis showed the site to be malicious and have malware and detected the below:

  • GT.JS.Injection.2.1bd84588
  • JS/Agent.PHC
  • javascript.malware.injection
  • Trojan.JS.SubberWorm
  • Trojan.Malscript
  • HEUR.Trojan.Script.Generic

I had already deleted the quarantined files so could not upload them to VirusTotal for further checks.

Other than browsing the site, I didn’t download any files or click on any prompts/ads.

I checked the antivirus activity logs and could see the same JavaScript files had been quarantined from the same site a few days before. I‘ve never had any malware/trojan alerts on a Mac previously.

I know Safari is sandboxed but I’m concerned as the files were still detected within the cache. I'm running macOS 14.1.2 build 23B92.

I want to know if I should take further actions based on this scenario.

Could the malicious cached files have been executed and affected anything outside of Safari?

 

2
  • Please update the question with the actual macOS version you are using. The 'latest' now will not be the 'latest' in 6 months. The idea of a Q&A site is to provide Q&A which are fairly robust over time and allow future readers and answerers to find something specific to their issue or solution respectively. They can be updated and added to as circumstances change. It's not just a question for 'now'. Dec 7, 2023 at 20:56
  • Welcome to Ask Different. We strongly prefer one question per question. I'm going to edit out the side questions and hopefully ask the one question you want. Please edit again if I guessed wrongly about your main question.
    – bmike
    Dec 12, 2023 at 3:06

1 Answer 1

1

On the whole, I would say you are quite well protected and safe:

  1. You are aware of several advice and remediation tools and that macOS can get malware.
  2. You are aware of sandboxing, logs, checking quarantined files and more.
  3. You describe a proper third party anti malware tool (but haven't named it - which is fine) so I would say you are probably more protected than most.
  4. It's unlikely you ran these files.
  5. You ran a very good tool - MalwareBytes anti malware scanner - that will catch the vast majority of known and identified malware, is updated regularly.
  6. Your only gap is software designed to catch non-fingerprinted, new and zero day type software that is rare (both in numbers and how long it can fly under the radar. Tools like Jamf Protect monitor behaviors at the OS level that often correlate with privacy and security compromise.

Of course, you can't be 100% sure you're not infected and something that isn't known is running, but I would say that is highly remote and you would have to be highly attractive a target (work for United Nations, work for a three letter government agency, are a likely target of powerful international countries or agencies, or are mistaken as someone worth a custom exploit and thousands of dollars of expense to infect).

I would immediately make a second backup - buy a second USB drive and get Time Machine running and rotate every month between the two drives (assuming you already are backing up with Time Machine regularly - if you aren't get two drives and start backing up). The reason to have two drives is one can sit offline for a month and if you get compromised and locked out of your data, you lose a month at most when your system and one connected backup drive are presumably damaged.

If you want - do an erase and reinstall, but that's a lot of time, and you would also need to screen your backup and reinstall everything. I'd probably just double my backup coverage and watch closely each week for a month or two.

Good Luck - I look forward to your answer once you know more or a few months go by and you get definitive answers based on your lived experience from this situation.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .