Trojan malware infests official HandBrake for Mac downloads

Hackers compromised a download server for HandBrake, a popular open-source program for converting video files, and used it to distribute a macOS version of the application that contained malware.

The HandBrake development team posted a security warning on the project’s website and support forum on Saturday, alerting Mac users who downloaded and installed the program from May 2 to May 6 to check their computers for malware.

The attackers compromised only a download mirror hosted under download.handbrake.fr, with the primary download server remaining unaffected. Because of this, users who downloaded HandBrake-1.0.7.dmg during the period in question have a 50/50 chance of having received a malicious version of the file, the HandBreak team said.

Users of HandBrake 1.0 and later who upgraded to version 1.0.7 through the program’s built-in update mechanism shouldn’t be affected, because the updater verifies the program’s digital signature and wouldn’t have accepted the malicious file.

Users of version 0.10.5 and earlier who used the built-in updater and all users who downloaded the program manually during those five days might be affected, so they should check their systems.

According to an analysis by Patrick Wardle, director of security research at Synack, the trojanized version of HandBrake distributed from the compromised mirror contained a new version of the Proton malware for macOS.

Proton is a remote access tool (RAT) sold on cybercrime forums since earlier this year. It has all of the features typically found in such programs: keylogging, remote access via SSH or VNC, and the ability to execute shell commands as root, grab webcam and desktop screen shots, steal files and more.

In order to obtain admin privileges, the malicious HandBrake installer asked victims for their password under the guise of installing additional video codecs, Wardle said.

The Trojan software installs itself as a program called activity_agent.app and sets up a Launch Agent called fr.handbrake.activity_agent.plist to start it every time the user logs in.

The HandBrake forum announcement contains manual removal instructions and advises users who find the malware on their Macs to change all of the passwords stored in their macOS keychains or browsers.

This is just the latest in a growing string of attacks over the past few years in which  attackers compromised software update or distribution mechanisms.

Last week Microsoft warned of a software supply chain attack in which a group of hackers compromised the software update infrastructure of an unnamed editing tool and used it to distribute malware to select victims: mainly organizations from the financial and payment processing industries.

“This generic technique of targeting self-updating software and their infrastructure has played a part in a series of high-profile attacks, such as unrelated incidents targeting Altair Technologies’ EvLog update process, the auto-update mechanism for South Korean software SimDisk, and the update server used by ESTsoft’s ALZip compression application,” the Microsoft researchers said in a blog post.

This is not the first time Mac users have been targeted through such attacks either. The macOS version of the popular Transmission BitTorrent client distributed from the project’s official website was found to contain malware on two separate occasions last year.

One way to compromise software distribution servers is to steal login credentials from developers or other users who maintain the server infrastructure for software projects. Therefore, it came as no surprise when earlier this year security researchers detected a sophisticated spear-phishing attack targeting open source developers present on GitHub. The targeted emails distributed an information stealing program called Dimnie.