The first Trojan in history to steal Linux and Mac OS X passwords
Published: 2012-08-22 · Archived: 2026-04-06 00:24:28 UTC
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies
related to the collection of visitor statistics.
Learn more
22.08.2012
Real-time threat news | Hot news | All the news | Virus alerts
August 22, 2012
Russian anti-virus company Doctor Web is reporting the emergence of the first cross-platform backdoor to
run under Linux and Mac OS X. This malicious program is designed to steal passwords stored by a number
of popular Internet applications. Mac.BackDoor.Wirenet.1 is the first such Trojan capable of running under
any of these operating systems.
It's not clear yet how the Trojan, which was added to the Dr.Web virus database as Mac.BackDoor.Wirenet.1,
spreads. This malicious program is a backdoor that can work under Linux as well as under Mac OS X.
When launched, it creates its copy in the user's home directory. The program uses the Advanced Encryption
Standard (AES) to communicate with its control server whose address is 212.7.208.65.
https://news.drweb.com/show/?i=2679&lng=en&c=14
Page 1 of 3

Mac.BackDoor.Wirenet.1 also operates as a keylogger (it sends gathered keyboard input data to intruders); in
addition, it steals passwords entered by the user in Opera, Firefox, Chrome, and Chromium, and passwords stored
by such applications as Thunderbird, SeaMonkey, and Pidgin. Anti-virus software from Doctor Web successfully
detects and removes the backdoor, so the threat does not pose a serious danger to systems protected by Dr.Web for
Mac OS X and Dr.Web for Linux.
2679 en 5
0
Doctor Web’s Q1 2026 review of virus activity on mobile devices
01.04.2026
Virus reviews
Read
https://news.drweb.com/show/?i=2679&lng=en&c=14
Page 2 of 3

Doctor Web’s Q1 2026 virus activity review
01.04.2026
Virus reviews
Read
Dr.Web for personal computers receives SKD AWARDS product excellence distinction
24.03.2026
Corporate news | Dr.Web products
Read
Source: https://news.drweb.com/show/?i=2679&lng=en&c=14
https://news.drweb.com/show/?i=2679&lng=en&c=14
Page 3 of 3