Mac trojan in the wild...

FYI…

- http://preview.tinyurl.com/5ogkay
June 21, 2008 (Computerworld) - "…Mac Trojan horse in the wild that could compromise machines running Apple Inc.'s Mac OS X 10.4 or 10.5. SecureMac, a Mac-specific anti-virus vendor, posted an alert last Thursday that its researchers had found a Trojan horse, dubbed "AppleScript.THT," being distributed from a hacker-operated site where discussions of spreading the malware via iChat, Apple's instant messaging and video chat software, were also taking place… The malware exploits a recently publicized vulnerability in the Apple Remote Desktop Agent (ARDAgent), part of Tiger's and Leopard's Remote Management component. Composed as a compiled AppleScript, or in another variant, script bundled into an application, the Trojan leverages the ARDAgent bug to gain full control of the victimized Mac…"
* http://www.securemac.com/applescript-tht-trojan-horse.php
Discovery: June 19, 2008

Apple Remote Desktop Root Privilege Escalation Vuln
> http://isc.sans.org/diary.html?storyid=4604
Last Updated: 2008-06-22 02:08:05 UTC

FYI…

- http://www.f-secure.com/weblog/archives/00001461.html
June 24, 2008
"… Trojan number one:
The exploit tool, called "Applescript Trojan horse template" was crafted by forum participants of MacShadows.com. These guys appear to have been hobbyist hackers interested in testing the ARDAgent vulnerability…
Trojan number two:
There was also another Mac OSX trojan discovered last week. This one was found by Intego*…"
* http://www.intego.com/news/ism0803.asp
"…A Trojan horse has been found in the wild masquerading as program for Mac OS X called “PokerGame”. The Trojan in question is a shell script encapsulated in an application, and is distributed in a 65 KB Zip archive; unzipped, it is 180 KB…"

(Screenshots available at both URLs above.)