Mac OS X Malware Disguised As Word and PDF Documents

Mac OS X Malware Disguised As Word and PDF Documents

Would you share this Article with others?  +

A new Mac OS malware called "Backdoor:Python/Janicab", disguised as a PDF and Word document has been discovered by internet security software maker, F-Secure. The malware uses the Right-to-Left override (RLO) trick to disguise itself as a PDF and Word document, by hiding the real extension of the file. This will trick someone into believing the file is a document instead of an application.

The RLO is a set of characters designed to support languages that are written right to left, such as Arabic and Hebrew, but can be used to make a malicious application look like a harmless PDF or Word document.

How can a malicious application be disguised as a harmless document?

Here is an example:
If the cybercriminals behind this malware want to disguise the application file “”, to make it appear as the PDF document file “RecentNews.ppa.PDF”, all they have to do is put the RLO unicode command for Right to Left override just before the letter  “F” in the file name “RecentNews.?  The question sign (?) inidicates where the "Right to Left"  character should be placed. This character is known as U+202E in the Unicode encoding standard.

This will make the file appear as if it is a PDF, although it is an application. This is because the last part of the file name (“”) will now read from right to left, therefore, making it be displayed as  “ppa.PDF” - -RecentNews.ppa.PDF.

If someone opens the file thinking it is a document, the malware will open silently in the background and display a sample document. This sample is a decoy, used to trick the user into believing that they have opened a document.

Once this Mac OS X malware is active on the infected computer, it will continuously spy on the user of the computer by taking screen shots of the computer  and record audio through the computer's microphone. These screen shots and audio recordings are then uploaded to the command and control server.

This malware will continuously check the Command and Control server for instructions from the cybercriminals behind this malware.

This malware also goes by the following names:

  • BackDoor.Janicab.1
  • Python/Janicab.A
  • TROJ_GEN.F47V0712
  • Mal/BredZpRTL-A
  • Backdoor:Python/Janicab.A

Macintosh computer users must be careful when opening document files like Adobe Acrobat (PDF) or Microsoft Word (DOC). Do not open documents from untrustworthy sources or documents sent as email attachment from unknown senders.

For information about this malware, please click here.

Note: Some of the names, addresses, email addresses, telephone numbers or other information in samples on this website may have been impersonated or spoofed.

Check the comment section below for additional information and share what you know or ask a question about this article by leaving a comment below.

Remember to forward suspicious, malicious, or phishing email messages to us at the following email address: And, report missing persons, scams, untrustworthy, or fraudulent websites to us. Tell us why you consider the websites untrustworthy or fraudulent. Also, to quickly find answers to your questions, use our search engine.

You can help maintain Online Threat Alerts (OTA) by paying a service fee. Click here to make payment.

Comments, Questions, Answers, or Reviews

There are no comments as yet, please leave one below or revisit.

To help protect your privacy, please do not post or remove, your full name, telephone number, email address, username, password, account number, credit card information, home address or other sensitive information in or from your comments, questions, or reviews. Also, remember to keep comments, reviews, answers respectful.

Write Your Comment, Question, Answer, or Review

Write your comment, question, answer, or review in the box below to share what you know or to get answers. NB: We will use your IP address to display your approximate location to other users.

Your comment, question, answer, or review will be posted as an anonymous user because you are not signed in. Anonymous posts cannot be edited or deleted. Sign-in.

Keep your comment respectful or it will not be posted.

Mac OS X Malware Disguised As Word and PDF Documents