A massive infection of computers based on the Mac OS X operating system with the Trojan program BackDoor.Flashback.39 has been registered. This was reported by the Russian manufacturer of anti-virus software Dr.Web.

The Dr.Web blog talks about 550 thousand infected machines. However, later, company analyst Ivan Sorokin in his microblog estimated their number at 600 thousand or more. More than half of the affected computers are located in the United States. Of these, 274 are located in Cupertino, where several large IT companies are based, including Apple .

The Trojan exploits a Java vulnerability. A computer is infected when visiting a site with a script that downloads a Java applet containing malicious code to the browser. A list of such resources is provided on the Dr.Web blog . Some users of the Apple forum also suspect the website of modem and router manufacturer D-Link of distributing the Trojan.

After installation, the program contacts the remote server for instructions. Computer security expert Brian Krebs claims that BackDoor.Flashback.39 steals logins and passwords, but Sorokin believes that its main purpose is to manipulate search traffic.

On April 3, Apple released an update to fix the Java vulnerability exploited by the Trojan. Ars Technica notes that Java developer Oracle closed a similar vulnerability on Linux and Windows in mid-February.

The BackDoor.Flashback.39 Trojan has been known in different variants since at least 2011. Early modifications of the program required the user to enter an administrator password. If the requirement was not met, no infection occurred. Later modifications infect the computer without entering a password.

More than 600 thousand Macs have picked up the Trojan