Ransomware attack on Macbook

[wild_turkey 3296]

My mom got a ransomware attack that locked her MacBook screen and showed a number for “Apple support” for her to call. She called the number and the “tech support” person convinced her to allow remote access. The person then looked at my mom’s computer and said that people were trying to get into it and her security software was out of date and my mom needed to pay “Apple” $199 to fix it. She said they only accept checks and not credit cards.

 

Luckily at this point my mom called me while the other person was still on the line waiting for check info. I told her to hang up immediately, power off her computer, and unplug the router. She did that. I then had her power the computer back on and she said it looked normal at this point. I told her to keep her internet access off for now. I also told her to back up any important files to a USB stick.

 

It sounds like a low level scam that almost worked but the check payment was too much of a red flag. They may try it again but at least she knows now. I’m not sure if they copied her files while remotely connected but there doesn’t seem to be much of value there. She doesn’t use the computer for banking except that she has Quicken for some business tax record keeping. I know nothing about Quicken but she doesn’t think any account numbers or SSNs were stored there.

 

I don’t know what else to have her do and I don’t use a Mac personally. Should she restore to backup? Is that a thing on a Mac? Change all other passwords just to be safe?

 

Thanks.

[TKthunder2 5059]

This happened to my grandmother, it sucks.

Change passwords 100%.
 

I don’t understand what restoring her files would do.  If you talking about wiping the laptop clean and restoring the files afterwards then that makes sense but it will be a big pain in the ass.

I don’t know enough about Macs to give anymore advice, but good luck.

[Nice Guy Eddie 13731]

Odds are that she was just on a website that tricked her into thinking she was a victim of ransomware.  As in, instead of going to amazon.com she typed in amaozn.com.

there are 100s of videos on YouTube where guys screw with these “tech” guys who are trying to scam an old lady.

still I would change all passwords and look into something that will check the laptop. Also a good time to scare mom in that any number that pops up on the screen or randomly calls her, is a scam. Not probably but 100% of the time.

[TwiceHorn 32079]

There's no such thing as a "restore point" in MacOS unless you are doing regular backups using Time Machine or other backup warez.

I'm a little skeptical that the scammer actually had remote access to her computer and any ability to install or leave malware.  It's possible, though.

 

[crash_davis 23470]

Thank god my mom is too stupid for a computer. Her incessant questions about using a tablet that she's had for 3 years is bad enough.

If she had a computer, she'd find a way to nuke the internet and bring us down with her.

[wild_turkey 3296]

I'm a little skeptical that the scammer actually had remote access to her computer and any ability to install or leave malware.  It's possible, though.

Apparently my mom questioned her legitimacy and the person was able to display an Apple ID badge on my mom’s screen. Now it’s entirely possible they did that via their malware without technically having full remote access. I’m not sure the level of sophistication of their scam but it sounds aomewhat poor because I would expect a more sophisticated scam to actually lock her computer until a ransom is paid, which does not seem to be the case. Then again, maybe that’s more of a Windows thing and not as common in Mac attacks.

[Nice Guy Eddie 13731]

Here's the scam. 

You know how you can be on a legit news website and you see those affiliate links with clickbait titles. I imagine if you go down the path on a few clicks, who knows where you end up. 

 

 

Edited October 1, 2020 by Nice Guy Eddie