Several security experts are now warning of a new Java 7 exploit they say could be “super dangerous” for Mac owners. The bug can be exploited through any browser on a machine that has Java installed, Metasploit’s Tod Beardsley told CompterWorld.
Beardsley called the bug “super dangerous,” noting that it was “totally a drive by,” meaning that attackers could compromise a Mac, or other personal computers, simply by duping users into browsing to a malicious or previously-hacked website that hosts the attack code.
The bug can even be found on Mountain Lion, the latest version of Apple’s OS X release.
The exploit is hosted on a website that resolves to an IP address in China. Its payload is a piece of malware that connects to a command and control server located in Singapore.
Security researcher Jaime Blasco said Monday in a blog post that the malware appears to be a variant of Poison Ivy, a so-called remote administration Trojan that has been used in many cyber espionage campaigns in the past.
The only known workaround or fix is to disable or uninstall Java, and avoid suspicious sites.
The warning recalls another infection scare from April of this year, when The “Flashback” malware infected numerous machines before it was patched by a software update and removal tool from Apple.
