Apple users beware: First live ransomware targeting Mac found 'in the wild' - CNET

"This is the first one in the wild that is definitely functional, encrypts your files and seeks a ransom," Olson said.

KeRanger is an unwelcome arrival for Apple fans who have long heralded the Mac as an untouchable rival to the traditional Windows PC. While PCs periodically make headlines for being targeted with viruses, malware and any number of digital infections, Mac users have largely been able to avoid serious anti-virus talk. Until now.

The stakes are high with KeRanger. Ransomware is designed to infect a computer and then hold the owner to ransom, locking up files or functionality and essentially bricking the device until the user pays to have the problem neutralised. This particular piece of ransomware brings with it a tidy $400 ransom note.

If a user installed one of the infected versions of Transmission, an executable file embedded within the software would run on the system. At first, there'd be no sign of a problem. But after three days, KeRanger would connect with servers over the anonymous Tor network and begin encrypting certain files on the Mac's system.

"After completing the encryption process, KeRanger demands that victims pay one bitcoin (about $400) to a specific address to retrieve their files," the researchers wrote in their findings. "Additionally, KeRanger appears to still be under active development and it seems the malware is also attempting to encrypt Time Machine backup files to prevent victims from recovering their back-up data."

The Palo Alto Networks team notified both Apple and the Transmission Project on March 4. Since then, they say Apple has revoked the security certificate exploited by KeRanger and updated its XProtect antivirus software. Apple declined to comment for this story.

The researches also note that Transmission has removed the affected versions of the BitTorrent installer from its website.

If you directly downloaded the Transmission installer from the official website on March 4-5, 2016, you may have been infected by KeRanger. Even if you downloaded it elsewhere or at another time, Palo Alto Network's security experts advise taking extra precautions. Head to their website to find out how to protect yourself.

Transmission is also recommending users should "immediately upgrade" to and run the latest version of its software, version 2.92, to ensure KeRanger is "correctly removed" if it is present on a user's Mac.

But how did KeRanger make it past the security guards in the first place?

According to Palo Alto Networks, "The KeRanger application was signed with a valid Mac app development certificate; therefore, it was able to bypass Apple's Gatekeeper protection."