In fact, the above fake password dialog comes from additional code that’s been compiled into the fake HandBrake distribution: the malware app ends up installed by the innocent-sounding name of activity_agent. app directories) like HandBrake, and both of them ask for your password at install time. pkg files) rather than as self-contained apps (. Nevertheless, it’s easy to fall for a fake password dialog of this sort: both Java and Flash, for example, arrive as installers (. A self-contained app shouldn’t need your system password just so it can download extra or updated components, in the same way your browser doesn’t need your password every time you initiate a download, so avoid entering your password in cases like this.A decent video player or converter may offer to download additional codecs, for example if you try to watch a video in some unusual format, but be wary of apps that force extra codecs on you at the start.(Codec is a widely-used jargon term meaning coder/decoder.) “Need a codec” is an old trick used by cybercrooks, so be suspicious of prompts like this on that basis alone.The HandBrake needs to install additional codecs prompt should ring alarm bells: The HandBrake app inside the DMG file starts running just as you might expect, but has had extra “secret sauce” compiled into it: The malware-infected download looks similar to the real thing when it’s opened:

Handbrake macbook