Intego VirusBarrier identifies and eradicates this new variant of Proton malware as OSX/Proton.D.

The truth is there is no new version of “CoinThief” malware, and the recommended Symantec Malware Detector is nothing but a way to con Mac users into installing a new variant of OSX/Proton. “To scan the system for all traces of the malware and completely remove CoinThief from the preinstalled software you can use our free tool – Symantec Malware Detector.” The blog symantecblog(.)com is a professional looking clone of the real Symantec blog, and even has a post on it about a “new version” of CoinThief, a trojan from a few years ago. The trick post concludes with the following recommendation:

Malware Watch Out! A Fake Antivirus Blog is Distributing Proton MalwareĪ new variant of OSX/Proton has been uncovered this week by malware researcher “noar” ( The previous iteration of Proton malware, discovered in October, had targeted Eltima, the makers of the Elmedia Player software. This time, OSX/Proton is being distributed as part of a fake antivirus scanner, named “Symantec Malware Detector,” found on a Symantec security blog that is equally fake.

Symantec antivirus for mac