Flashback Malware Still Affecting over 100,000 Macs

While Apple has pushed out several software updates to detect the Flashback malware and remove it from infected systems, Symantec noted late yesterday that over 100,000 machines remain afflicted by the issue as detected by their sinkhole operation to redirect server traffic.

flashback sinkhole infections
Symantec pegged the number at approximately 142,000 as of Monday, listing a rough estimate of "over 99,000" as yesterday's data was still coming in. Those numbers are down from a peak of over 600,000 machines two weeks ago, but a substantial number of machines are still infected by the malware.

The statistics from our sinkhole are showing declining numbers on a daily basis. However, we had originally believed that we would have seen a greater decline in infections at this point in time, but this has proven not to be the case. Currently, it appears that the number of infected computers has tapered off, but remains around the 140,000 mark.

As there have been tools released by Symantec and other vendors in the past few days concerning this threat, the infection numbers should have seen a dramatic decrease by now.

Symantec also takes a look at the domain name generator that allows infected machines to connect to their command-and-control servers to receive instructions. The generator uses a list of 14-character strings rotated each day, coupling each string with one of five top-level domains (.com, .net, .info, .in, or .kz) to find its instructions.

The report also claims that Flashback-infected systems can receive updated command-and-control server locations through Twitter, although no details on that process are provided. A similar claim was made for earlier versions of Flashback, although there has apparently been no demonstration of the Twitter delivery method actually being used.

Popular Stories

iphone 17 dummies sonny dickson

iPhone 17 Air Almost as Thin as Its Buttons, New Images Show

Thursday April 24, 2025 2:14 am PDT by
If you missed the video showing dummy models of Apple's all-new super thin iPhone 17 Air that's expected later this year, Sonny Dickson this morning shared some further images of the device in close alignment with the other dummy models in the iPhone 17 lineup, indicating just how thin it is likely to be in comparison. The iPhone 17 Air is expected to be around 5.5mm thick – with a thicker ...
iphone 17 air dummy unbox therapy

iPhone 17 Air's Extreme Thinness Demoed in New Video

Tuesday April 22, 2025 10:22 am PDT by
Apple plans to release an all-new super thin iPhone this year, debuting it alongside the iPhone 17, iPhone 17 Pro, and iPhone 17 Pro Max. We've seen pictures of dummy models, cases, and renders with the design, but Lewis Hilsenteger of Unbox Therapy today showed off newer dummy models that give us a better idea of just how thin the "iPhone 17 Air" will be. The iPhone 17 Air is expected to be ...
AirPods Pro 3 Mock Feature

AirPods Pro 3 Just Months Away – Here's What We Know

Friday April 18, 2025 5:16 am PDT by
Despite being more than two years old, Apple's AirPods Pro 2 still dominate the premium wireless‑earbud space, thanks to a potent mix of top‑tier audio, class‑leading noise cancellation, and Apple's habit of delivering major new features through software updates. With AirPods Pro 3 widely expected to arrive in 2025, prospective buyers now face a familiar dilemma: snap up the proven...
iPhone 17 Pro Blue Feature Tighter Crop

iPhone 17 Pro Launching Later This Year With These 13 New Features

Wednesday April 23, 2025 8:31 am PDT by
While the iPhone 17 Pro and iPhone 17 Pro Max are not expected to launch until September, there are already plenty of rumors about the devices. Below, we recap key changes rumored for the iPhone 17 Pro models as of April 2025: Aluminum frame: iPhone 17 Pro models are rumored to have an aluminum frame, whereas the iPhone 15 Pro and iPhone 16 Pro models have a titanium frame, and the iPhone ...
ipad air windows 11 arm

M2 iPad Air Runs Windows 11 ARM via Emulation, Thanks to EU Rules

Tuesday April 22, 2025 5:01 am PDT by
A developer has demonstrated Windows 11 ARM running on an M2 iPad Air using emulation, which has become much easier since the EU's Digital Markets Act (DMA) regulations came into effect. As spotted by Windows Latest, NTDev shared an instance of the emulation on social media and posted a video on YouTube (embedded below) demonstrating it in action. The achievement relies on new EU regulatory...
iPhone 17 Air Pastel Feature

iPhone 17 Air Launching Later This Year With These 16 New Features

Thursday April 24, 2025 8:24 am PDT by
While the so-called "iPhone 17 Air" is not expected to launch until September, there are already plenty of rumors about the ultra-thin device. Overall, the iPhone 17 Air sounds like a mixed bag. While the device is expected to have an impressively thin and light design, rumors indicate it will have some compromises compared to iPhone 17 Pro models, including only a single rear camera, a...
Global Close Your Rings Day Pin

Apple Stores Giving Away a Limited-Edition Pin For Free Today

Thursday April 24, 2025 10:15 am PDT by
Starting today, April 24, Apple Stores around the world are giving away a special pin for free to customers who request one, while supplies last. Photo Credit: Filip Chudzinski The enamel pin's design is inspired by the Global Close Your Rings Day award in the Activity app, which Apple Watch users can receive by closing all three Activity rings today. The limited-edition pin is the physical...
Apple Logo Spotlight Blue

White House Hits Back at Apple's Massive EU Fine

Thursday April 24, 2025 5:57 am PDT by
Apple's $570 million fine from the EU has triggered a sharp rebuke from the White House, which called the fine a form of economic extortion, Reuters reports. The fine was announced on Wednesday by the European Commission, following a formal investigation into Apple's compliance with the bloc's Digital Markets Act (DMA), a landmark piece of legislation aimed at curbing the market dominance of ...
iphone 16 pro models 1

17 Reasons to Wait for the iPhone 17

Thursday April 17, 2025 4:12 am PDT by
Apple's iPhone development roadmap runs several years into the future and the company is continually working with suppliers on several successive iPhone models simultaneously, which is why we often get rumored features months ahead of launch. The iPhone 17 series is no different, and we already have a good idea of what to expect from Apple's 2025 smartphone lineup. If you skipped the iPhone...

Top Rated Comments

chrono1081 Avatar
170 months ago
I don't understand the concern everyone has. One trojan that infected 1% of Macs (thats right, 1%) and is easily fixed with an update compared to over a million known malware variants on Windows systems is nothing.
Score: 7 Votes (Like | Disagree)
Santabean2000 Avatar
170 months ago
Seems like a lot, but I guess not as a percentage. Still, new threats, I fear, will soon become the norm.

It was good while it lasted.


I hope I'm wrong.
Score: 6 Votes (Like | Disagree)
Henriok Avatar
170 months ago
As I installed today's Flash update, I thought to myself: how am I supposed to know if this is really Flash, or if this is actually a trojan?
Don't act on someone else's initiative. Act on your own.
If you see on some news site, or via some popup dialog, that Flash (or any other software) is updated, then go to the download site by yourself, or invoke the update process provided in the software.

Let's say that Software Update says that there's some software that needs to be updated. Read what the update is about and click [Cancel]. Then, you go to Software Update by your own action and run it. If it says the same thing as before, you go ahead and upgrade.

The first instance COULD've been a Trojan that just happens to mask itself as Software Update, or Flash updater, or some other updater/installer.
But, if you run through the process by your self manually, and according to standard procedure, you won't invoke any Trojan.

…probably. If you follow this, you won't get infected by ANY trojan that I know of and you won't get phished, or scammed by any email.
Score: 5 Votes (Like | Disagree)
caligomez Avatar
170 months ago
Do we really need antivirus software for Macs? I mean, assuming the growth of the platform, and that more and more malicious programs will be written.. I consider myself pretty smart in avoiding infection, but it only takes one savy developer to trick you with some method you didn't anticipate..

I don't have any type of security software.. Should I? If so, which is the best for Mac?
Score: 5 Votes (Like | Disagree)
macsmurf Avatar
170 months ago
You know I don't like to spread conspiracy garbage. But on this topic every story says these are estimated numbers or a best guess. Even still 100,000 is less than 1% of Mac users. How is this even an outbreak or panic like the media is portraying? I've gone around and checked about 100 of the machines at my work not a single one of them was infected. None of my friends have been infected and none of my home machines have been infected. So I'm starting to believe this is all BS that the antivirus companies are putting out so that you purchase their software subscriptions. I just feel they really want to be in the Mac market and capture Windows switchers.
The starting number was around 600 000 or 1% of mac computers worldwide. That's on par with the Conficker outbreak which is the largest outbreak in the history of Windows, AFAIK. Of course, many more Windows machines were infected but taking the total number of Windows machines into account the percentage of infected machines was around 1%.

Conficker was a fairly sofisticated worm with implementations of quite a lot of different attacks. In that light, 1% for the comparatively much simpler Flashback malware is actually very widespread. The two month delay in releasing the fix was probably a big contributing factor along with the widespread belief that Macs don't get viruses.

It great to see that the number has gone down but 100 000 infected is still nothing to sneeze at (excuse the punnage).
Score: 4 Votes (Like | Disagree)
chrono1081 Avatar
170 months ago
1% who has reported the issue, which is about the amount of mac users who join forums.
The other 99% may be infected and may not know because they have been told the mac is "safe" and protected from such things.
No the 1% is the actual number of infected whether they know it or not.

http://www.redmondpie.com/apple-releases-standalone-flashback-malware-removal-tool-for-non-java-mac-users-download-now/ (http://www.redmondpie.com/apple-releases-standalone-flashback-malware-removal-tool-for-non-java-mac-users-download-now/)

They don't measure it by the amount of people reporting it, they measure it by seeing what the trojan is doing.
Score: 4 Votes (Like | Disagree)