Well, CyberReason is one of the good guys!

Their claim to my respect is that they got an actual "legal" threat from a malware company's "lawyers"!  The company is "TargetingEdge", the malware is "OSX.Pirrit", and it runs on Macs.

Nice, this will tell the FBI exactly who to chase :-)

TargetingEdge claims the software isn't malware, but based on the following, this is like claiming Wilbur in Charlottes Web isn't a pig. According to Amit Serper, who wrote the analysis of the code: Maker of Sneaky Mac Adware Sends Security Researcher Cease-and-Desist Letters

As for OSX.Pirrit malware, it runs under root privileges, creates autoruns and generates random names for itself on each install. Plus, there are no removal instructions and some of its components mask themselves to appear like they’re legitimate and from Apple. And don’t forget that TargetingEdge used domains that appeared to be generated by some sort of DGA and made many attempts to hide any link between the domains and TargetingEdge.

Slashdot starts a good thread: Maker of Sneaky Mac Adware Sends Security Researcher Cease-and-Desist Letters (zdnet.com)

CyberReason's  analysis of the code can be found here

Amit - If I run into you in Boston area, let me buy you a beer!

Yes, folks, supply chain risks through third party libraries is a thing...

Yes, folks, supply chain risks through third parties is a thing... 

And at a banking site to boot: https://www.bankinfosecurity.com/equifax-transunion-websites-served-up-adware-malware-a-10379

Well, not really banking, credit reporting services, like Equifax or Transunion,  are using code for web reporting.

It's kinda malvertising, where the site has links that go outside, but I think it's include files, that go to a site on the fly, which is compromised, and serving up fake flash malware, which in this case is Adware.Eorezo.

There's also talk about third party providers in general https://www.pymnts.com/news/b2b-payments/2017/bitsight-financial-services-face-third-party-cybersecurity-risk/


Malwarebytes is quoted multiple times and has a good blog post https://blog.malwarebytes.com/threat-analysis/2017/10/equifax-transunion-websites-push-fake-flash-player/