Intego, makers of VirusBarrier and other security software for the Mac, says it has discovered a new Trojan horse in pirated copies of Apple's iWork '09 productivity suite circulating on a number of torrent sites. According to the security firm, the package is installed as a system-wide startup item, where it has read-write permissions as root and could allow malicious users to take charge of the machine remotely.
The Trojan, which was classified as a "serious" risk and named OSX.Trojan.iServices.A, can not only install additional components but can also modify existing apps, making it extremely difficult to remove. Intego reports that over 20,000 users have downloaded the package and notes that the Trojan now appears to be actively downloading new code to infected machines and using them to carry out DDoS attacks on certain websites.
Intego's advisory is yet another reminder of the growing popularity of OS X and, interestingly enough, it comes just a day after Apple announced that they will be removing serial key piracy protection from retail copies of iWork '09.