Symantec has reported a new malwarefor Mac called OSX.Crisis, which has functionality to spread to four different environments: Mac, Windows, virtual machines, and Windows Mobile.
OSX.Crisis is an advanced threat not only in function, but also in the way it spreads. The threat uses three methods to spread itself: one is to copy itself and an autorun.inf file to a removable disk drive, another is to sneak onto a VMware virtual machine, and the final method is to drop modules onto a Windows Mobile device.
Specifically in virtual environments, the threat searches for a VMware virtual machine image on the compromised computer and, if it finds an image, it mounts the image and then copies itself onto the image by using a VMware Player tool.
The malware takes advantage of an attribute of all virtualization software: namely that the virtual machine is simply a file or series of files on the disk of the host machine. These files can usually be directly manipulated or mounted, even when the virtual machine is not running as is the case above.