Chinese Developer Hides Malware in App Store App for macOS

A Chinese publisher has managed to trick Apple’s vigilance, which has accepted malicious applications in the App Store for macOS.

Apple devotes much of its communication to the security of the App Store, and its application store, justifying more closed ecosystems than Android or Windows. But even the apple brand is not foolproof and can overlook threats. This is according to a report by Alex Kleber, a cybersecurity researcher, who identified several malicious Chinese apps in the macOS App Store.

The investigation revealed seven different Apple developer accounts that actually belonged to a single China-based publisher. Applications of this editor include hidden malware that can receive commands from a server. Thus, the malicious code can only be activated after the application in question has been approved by the App Store, thus misleading Apple’s security systems.

Fake reviews and paid subscription for macOS App Store apps

With this technique, the developer can even completely change the interface of the application. Thus, the app validated by Apple does not resemble the app that is ultimately downloaded and installed by users.

To make it more difficult to trace them, all communication goes with domains that use services like Cloudflare and GoDaddy, which allows them to hide their hosting provider. One of the applications is a PDF reader that has been downloaded countless times from the App Store for macOS in the United States, making it even one of the most installed apps.

The app requires a paid subscription while offering the same functionalities as any regular free PDF reader or even not working at all. To make you believe that the app is legit and entices users to download it, it has drowned in false positive feedback, hiding the real opinions that denounce it. Since the report was published, Apple has responded by removing many fake reviews of these apps. Some have even been removed from the App Store altogether.