A hacking operation targeted at Mac users is doing quite well thanks to a 'feature' on the Mac which allows anyone to use the scutil command to change the DNS server.

OSX.RSPlug.A, which is designed specifically for Mac OS X systems, has been discovered on several pornography Websites that can hijack Web traffic.

According to security outfit Intego, affected systems are used to hijack some Web requests that lead users to other phishing sites, or simply display ads for other pornographic Websites to generate ad revenue. It is designed to make Apple users think that they are are surfing on eBay, Paypal, or various banking Web sites, when actually they are accessing fake sites designed to retrieve usernames and passwords for those sites.

OSX.RSPlug.A, is rated 'critical' by Intego and can take down all versions of the Mac OS X, including the latest Leopard.

The Trojan asks to install a video codec necessary for viewing free porn on Macs. Safari users who have checked the "Open 'Safe' Files After Downloading" option will find the Trojan automatically mounts itself because their browser is certain that the dodgy code is safe. The trojan exploits quirks in OS-X. It first changes the Mac's DNS server and sends users to a poisoned one instead.

Features in Tiger prevent users from noticing that their DNS server has changed in the GUI. Leopard users spot the change in their advanced network preferences, but cannot do anything about it.

More here.