Torrented Copies of iWork ‘09 Come Laced With a Nasty OS X Trojan

This may be a first for the Mac software world, and it’s not cool at all: ill-gotten copies of iWork ‘09 circulating on Torrent sites contains OSX.Trojan.iServices.A, which is something you don’t want.

The Trojan parks itself in your /System/Library/StartupItems folder with read-write-execute root privileges–from there it can phone home to a remote server and install additional nasties throughout your system. Right now, the only true fix is a full format and re-install, since its residual pieces can be spread far and wide. You can spot if your particular warez iWork is infected by searching for the iWorkServices.pkg inside the installer.

It was spotted security software company Intego, who have spotted several OS X security threats in the past. But as far as I can tell, this is the first one to come piggybacking along with a popular software package many people are pirating (Intego says 20,000 downloads).

If you’re in the demographic whopirating iWork ‘09 via BitTorrent, chances are this is as close as you’re come to getting VD from an ill-advised Southeast-Asian sex-professional liaison. Still, not a good precedent to set. [Intego]