Security firm Intego warns that another version of the iServices Trojan, OSX.Trojan.iServices.B, was discovered to be bundled with copies of Adobe Photoshop CS4 for Mac. Just like in the previous case, the infected Adobe Photoshop CS4 is being distributed via BitTorrent trackers and other sites containing links to pirated software.

As expected, the Trojan itself is found in a crack application that serializes the program, while actual Photoshop installer is clean. When launched, the crack will ask the user to input the administrator password, thus granting the malware with root privileges.

Then, it extracts an executable from its data and installs a backdoor in /var/tmp/, a directory which is not deleted when the computer is restarted. Even worse, if the crack is to be run again, it will create a new executable with a different name, making it much harder to be detected and removed.

According to Intego, 5,000 people had already downloaded the infected application.