Router High-jack

I recently had an DNS server high-jack of my Xfinity router and my MacBook Pro was infected with a ton of malware. We think my computer was being monitored and infected for weeks. I am fastidious about internet security and we have no idea how it happened, but it was incredibly stealth. I took my laptop to my tech who I have used for years and absolutely trust and he wiped it clean and reinstalled everything. MalwareBytes says my computer is clean of any malware, however, my anti-virus will periodically quarantine a ton of files. I run a daily scan, and sometimes it is clean and sometimes it will still find a few PhishingX-gen files. Today it quarantined a ton of files on its own and then I ran a deep scan and it found more.


First, let me say, please do not tell me that viruses and malware cannot infect Macs because that is absolutely wrong. It happened to us. I’ve read where these types of things can get through a back door and still pop up even after an entire computer wipe.


My question is this, who can I talk to at Apple, they are usually never any help. They just say it is not possible to get a virus or malware. Has anyone else out there had anything like this happen and if so, what steps did you take? I am on the verge of just getting a new laptop and starting over, but before I do, I thought I’d reach out here and see if anyone had any other solutions. I just cannot get over the feeling there is something still lurking in my computer.

Earlier Mac models

Posted on Oct 9, 2023 10:43 AM

Reply
Question marked as Top-ranking reply

Posted on Oct 10, 2023 9:12 PM

Keep in mind that any other devices connected to your router could be compromised as well. This includes any networked appliances like smart TVs, smart refrigerators, smart washer/dryer, home monitoring systems & cameras, etc. since many of these other devices have terrible security and are not always updated with patches to fix known vulnerabilities. If your Mac got infected with malware from that DNS hijacking, then there is a good chance any other smart networked appliance/device has also been infected and may still be infected and possibly affecting your router and computers. Sometimes a simple power cycle can remove the infection from those devices if the infection has only occurred to the memory of the device and not its firmware.


There is no need for a traditional anti-virus app on a Mac. Anti-virus apps, cleaning/optimizer apps, and third party security software are not needed on a Mac and usually causes more problems than they solve. If a user suspects their Mac has been infected with malware & adware, then running MalwareBytes to scan the system is fine and is the exception to the rule. MalwareBytes is better behaved than the other apps, but even so there is no need to have MalwareBytes running a real-time scanner since it can also interfere with the normal operation of macOS.


Many of the traditional anti-virus products are complete junk today with some of them actually selling user's personal information and supplying ads to the user. I won't even use them on a Windows system because Microsoft's built-in anti-virus software works well enough these days. macOS already has great built-in security as long as the user also practices safe computing habits as outlined in this article written by a respected forum contributor and keeps the OS and all apps fully updated & patched:

Effective defenses against malware and other threats - Apple Community


Every system is vulnerable due to bugs in the software and operating systems, but the risks are low if users are careful. Of course any device exposed to the Internet, such as your Comcast router is at the highest risk of being compromised. If you are using the Comcast supplied router, then about all you can possibly do is to change the default admin login & password and disable remote administration of the router to prevent anyone on the Internet from compromising the router. You are at the mercy of Comcast to keep the router's firmware up to date. Or you could purchase & use your own router in place of the Comcast router so that you can make sure to keep the router's firmware up to date and to get a router which may be known for better out of box security. Unfortunately you are at Comcast's mercy in regards to the modem security.


As long as you performed a clean install of macOS on the computer, then it should be clean. A clean install involves first erasing the drive before reinstalling macOS. How you erase the drive varies between Intel & Apple Silicon Macs. For an Intel Mac it would be best to erase the entire physical drive, but with an Apple Silicon Mac you can only delete the Volume Group which leaves the rest of the SSD untouched (has required system files to access the special boot modes so erasing the whole SSD will break an Apple Silicon Mac). With the 2018+ Macs, you have the option to perform a firmware "Restore" which resets the security enclave & firmware and erases the internal SSD for macOS. With an Apple Silicon Mac the firmware "Restore" will also push a clean copy of macOS onto the internal SSD (the 2018-2020 Intel Macs require you to boot into Internet Recovery Mode to reinstall macOS afterwards). You do not want to restore everything from a backup or you could cause the malware infection to return. It would be best to only migrate your data files. And to download & install fresh copies of your third party apps.

Revive or restore an Intel-based Mac using Apple Configurator - Apple Support


Revive or restore a Mac with Apple silicon using Apple Configurator - Apple Support


I can certainly understand having that feeling of insecurity after having been compromised, but at least you know how it began. As long as your router has been taken care of (most likely replaced I would imagine), then a clean install of macOS with just restoring the data files should mean your computer is now clean & safe. I would make sure to power cycle any smart appliances just to be safe as well (and I would disconnect them from the router to be doubly safe since smart appliances/devices are known to have terrible security).



Similar questions

3 replies
Question marked as Top-ranking reply

Oct 10, 2023 9:12 PM in response to -scared_

Keep in mind that any other devices connected to your router could be compromised as well. This includes any networked appliances like smart TVs, smart refrigerators, smart washer/dryer, home monitoring systems & cameras, etc. since many of these other devices have terrible security and are not always updated with patches to fix known vulnerabilities. If your Mac got infected with malware from that DNS hijacking, then there is a good chance any other smart networked appliance/device has also been infected and may still be infected and possibly affecting your router and computers. Sometimes a simple power cycle can remove the infection from those devices if the infection has only occurred to the memory of the device and not its firmware.


There is no need for a traditional anti-virus app on a Mac. Anti-virus apps, cleaning/optimizer apps, and third party security software are not needed on a Mac and usually causes more problems than they solve. If a user suspects their Mac has been infected with malware & adware, then running MalwareBytes to scan the system is fine and is the exception to the rule. MalwareBytes is better behaved than the other apps, but even so there is no need to have MalwareBytes running a real-time scanner since it can also interfere with the normal operation of macOS.


Many of the traditional anti-virus products are complete junk today with some of them actually selling user's personal information and supplying ads to the user. I won't even use them on a Windows system because Microsoft's built-in anti-virus software works well enough these days. macOS already has great built-in security as long as the user also practices safe computing habits as outlined in this article written by a respected forum contributor and keeps the OS and all apps fully updated & patched:

Effective defenses against malware and other threats - Apple Community


Every system is vulnerable due to bugs in the software and operating systems, but the risks are low if users are careful. Of course any device exposed to the Internet, such as your Comcast router is at the highest risk of being compromised. If you are using the Comcast supplied router, then about all you can possibly do is to change the default admin login & password and disable remote administration of the router to prevent anyone on the Internet from compromising the router. You are at the mercy of Comcast to keep the router's firmware up to date. Or you could purchase & use your own router in place of the Comcast router so that you can make sure to keep the router's firmware up to date and to get a router which may be known for better out of box security. Unfortunately you are at Comcast's mercy in regards to the modem security.


As long as you performed a clean install of macOS on the computer, then it should be clean. A clean install involves first erasing the drive before reinstalling macOS. How you erase the drive varies between Intel & Apple Silicon Macs. For an Intel Mac it would be best to erase the entire physical drive, but with an Apple Silicon Mac you can only delete the Volume Group which leaves the rest of the SSD untouched (has required system files to access the special boot modes so erasing the whole SSD will break an Apple Silicon Mac). With the 2018+ Macs, you have the option to perform a firmware "Restore" which resets the security enclave & firmware and erases the internal SSD for macOS. With an Apple Silicon Mac the firmware "Restore" will also push a clean copy of macOS onto the internal SSD (the 2018-2020 Intel Macs require you to boot into Internet Recovery Mode to reinstall macOS afterwards). You do not want to restore everything from a backup or you could cause the malware infection to return. It would be best to only migrate your data files. And to download & install fresh copies of your third party apps.

Revive or restore an Intel-based Mac using Apple Configurator - Apple Support


Revive or restore a Mac with Apple silicon using Apple Configurator - Apple Support


I can certainly understand having that feeling of insecurity after having been compromised, but at least you know how it began. As long as your router has been taken care of (most likely replaced I would imagine), then a clean install of macOS with just restoring the data files should mean your computer is now clean & safe. I would make sure to power cycle any smart appliances just to be safe as well (and I would disconnect them from the router to be doubly safe since smart appliances/devices are known to have terrible security).



Oct 9, 2023 12:02 PM in response to -scared_

Trojan emails do not necessarily come from your Mac, but rather someone on a mailing list your email address is shared with. All it takes is one email to go through an infected PC, and all emails on the mailing list can be implicated in spam, and phishing attacks, even if they never came from that email account.


When you use the To: or CC: fields in emails, that's when the risk is highest. It is better to join single point of contact mailing lists that hide every member's address from the header of the email or use BCC in the field.


Once implicated, you sometimes get blacklisted by realtime blackhole list sites known as RBL, and that prevents Spamcop and other spam filters from allowing your emails to go through.


If your evidence of viruses is not through email please state the exact nature of symptoms.


The only other utilities I trust for virus detection on Macs are Sophos, Clam AV, and Avast. Subscription to any of these services is not worthwhile.


If you run Windows on a Mac, it is just the Windows environment that really poses risks of infection.

However, if you are seeing symptoms, they are more than likely because you downloaded some application that runs in the background that slows you down. Advanced Mac Cleaner, and Mac Keeper are the worst of these applications, as they try to clean up what the OS already cleans on its own. Your best optimization is just keeping your hard drive from being more than 85% full, and only installing that software which meets specs, and not using any file sharing service for unauthorized content or unlicensed software. As long as you are doing that, the risk of viruses is very minimal. Please share the symptoms you are getting, and we can tell you exactly what the cause is.


Etrecheck - the handy reporting tool for … - Apple Community

is a great tool for identifying background applications that the community uses to identify suspect applications.


Contacting Apple through Apple Support you might want to speak to customer relations if the front line Apple Support can't answer you. We are just end users here.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Router High-jack

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.