You may recall Richard Gaywood's intriguing post asking "where is the Mac malware explosion, then?" on 21 July - where he pointed out that there hadn't been any updates to the MacDefender virus definitions on the Mac since 18 June.
This may be the answer.
Hop over to Brian Krebs's excellent Krebs On Security, where he notes that the "Fake antivirus industry is down, but not out":
Many fake antivirus businesses that paid hackers to foist junk security software on PC users have closed up shop in recent weeks. The wave of closures comes amid heightened scrutiny by the industry from security experts and a host of international law enforcement officials. But it's probably too soon to break out the bubbly: The inordinate profits that drive fake AV peddlers guarantee the market will soon rebound.
What's happened is that the payment companies that the fake AV companies used have seen clampdowns which have stopped them from making payments to their would-be clients. When the money doesn't flow, the payments don't get taken.
Krebs also says that "There may be another reason for the disruption: On June 23, Russian police arrested the co-founder of Russian online payment giant ChronoPay and a major player in the fake AV market." Krebs had written in May that there seemed to be a connection between ChronoPay and the appearance of MacDefender; he suggested that it was employees of ChronoPay who were pushing it. ChronoPay had issued a statement denying it.
This is where it gets interesting: inside the Chronopay offices in Moscow, Krebs says police found "mountains of evidence that ChronoPay employees were running technical and customer support for a variety of fake AV programs, including MacDefender." (There's a photo from the offices; though much of it is in Russian, it does have the names of various fake AV products.)
So, Saturday 18 June, last new version of MacDefender; Thursday 23 June, raid on offices. Quite possibly things just got a bit tight at ChronoPay and so they couldn't do the new updates.
But Krebs does point to one problem: fake AV is "ridiculously profitable". Once you get a few thousand installs, you're basically printing money. So even though MacDefender is (probably) gone, the possibility - probability? - remains that fake AV scams, and possibly worse, are being cooked up by people looking to cash in on Apple users as well as Windows ones.
