Security company Moysle is warning Mac users about a new malware attack that may operate undetected. The malware, dubbed JSCoreRunner, spreads through what appears to be a free PDF converter app distributed on a website with the domain fileripple.com that offers an app called Ripple Effect.

The attack starts after a user downloads the FileRipple.pkg file from the website. According to Moysle via a report by 9to5Mac, when the user unpacks the file, “a fake webview” displays a PDF tool that appears legitimate, but “malicious activity runs silently in the background.” The Mac’s built-in security, however, has a record of the package’s signature as a revoked one, so the package is blocked. But a second stage is involved, where an unsigned package named Safari14.1.2MojaveAuto.pkg runs and installs the malware.

Once installed, the JSCoreRunner malware targets Google Chrome profiles on macOS. It modifies the browser’s search engine settings so that users are redirected to a fraudulent search engine to collect user information. Moysle reports that users might not even know they’re infected due to the malware’s “sophisticated” efforts to hide crash logs and pop-ups. 

How to protect yourself from malware

The easiest way to avoid malware is to use only apps that are legitimately acquired from trusted sources, such as the App Store (which performs security checks on its software) or directly from the developer.

Macworld has several guides to help, including a guide on whether or not you need antivirus software, a list of Mac viruses, malware, and trojans, and a comparison of Mac security software.

Apple has protections in place within macOS and the company releases security patches through OS updates, so it’s important to install them when they are available. If Apple pulls back an update, the company will reissue it as soon as it is properly revised with corrections.