Trojans and infostealers: when you install the attacker yourself

The name comes from the wooden horse of Greek legend: a gift that carried soldiers through the city gates. A trojan horse in computing works the same way. NIST describes it as a program that appears to have a useful function but also has a hidden and potentially malicious one that evades security mechanisms, sometimes by exploiting the legitimate permissions of the person who runs it. That last part is the key idea. A trojan rarely needs a clever break-in, because you open the gate for it.

The disguises that work

Trojans take whatever shape people are most likely to install without thinking twice. On the Mac, the same few disguises come back again and again:

• Cracked or “free” versions of expensive software: design tools, video editors, office suites, games.
• Fake updates: a web page claiming your browser or a plug-in must be updated before a video will play.
• Lookalike downloads: a search advert for a well-known app pointing to a site with a near-identical name.
• Fake meeting or chat apps: a “colleague” or “recruiter” sends a link to install a special video-call client.
• Fake crypto wallets and trading tools, aimed at people who already hold cryptocurrency.
• Useful-looking utilities: cleaners, converters, VPNs and “speed-up” tools from unknown developers.

MITRE ATT&CK calls the general trick masquerading: making a malicious file look like a legitimate one, through its name, its icon or its location. Combined with a believable reason to install it, masquerading is enough to get past people who are careful most of the time.

Infostealers: the most common goal

Many trojans on the Mac today are infostealers. Once running, they try to collect everything that can be turned into money or access: passwords saved in browsers, session cookies that keep you logged in, the contents of the keychain, crypto wallet files, documents from the Desktop and Downloads folders, and details about the computer. The stolen data is packed up and sent to a server controlled by the attacker, often within minutes.

Session cookies deserve special mention. If a thief copies the cookie that keeps you logged into an email or social account, they may be able to use that session without knowing your password and without passing two-factor authentication, until the session expires or you log out everywhere. This is why, after an infection, changing passwords alone is not enough: you also need to sign out of all sessions.

What macOS already does

Apple’s protections are aimed squarely at this kind of threat. Gatekeeper checks that apps downloaded from the internet are signed by an identified developer and notarized by Apple, which means they were scanned for known malicious content before distribution. XProtect recognises known malicious software and can block or remove it. Apple can also revoke a developer’s certificate once abuse is discovered. These layers are real and effective against known threats. Their weak point is the same as the trojan’s strength: a user who is persuaded to approve something anyway.

Habits that stop most trojans

• Download apps from the Mac App Store or the developer’s own website, typed in by hand or reached from a trusted bookmark, not from search adverts.
• Never install cracked software. It is the single most reliable way to install a trojan yourself.
• Treat any page that says you need an update to watch a video as a trap. Update apps from within the app or through System Settings.
• Be wary of meeting links that require installing a special client you have never heard of, especially from new contacts.
• Read macOS warnings. If an installer asks you to work around one, stop.
• Use a password manager and passkeys where possible, so stolen browser passwords are less valuable.

Seeing a trojan call home

An infostealer has to send what it stole somewhere. That outbound connection is often the first moment it becomes visible. FireAI asks before an app connects for the first time, so a newly installed “utility” that immediately tries to reach an unfamiliar server produces a question rather than silence. You can deny it, see on the world map where it was trying to go, and ask the on-device AI to explain the connection. FireAI does not scan files or remove malicious software; its job is to show and control what leaves your Mac, which is exactly what an infostealer depends on.

If you think you installed one

• Disconnect from the internet first, to stop further data from leaving.
• Remove the app and check Login Items and background items in System Settings for anything you do not recognise.
• From a different, trusted device, change the passwords of your most important accounts: email first, then banking and anything linked to money.
• Sign out of all sessions in those accounts, to invalidate stolen cookies.
• If cryptocurrency was on the Mac, move funds to a new wallet created on a clean device.
• If you are unsure the Mac is clean, get professional help or restore from a backup made before the infection.