The NightOwl app, which was once a popular option for automatically transitioning between dark and light modes on macOS Mojave, has been identified to secretly store user data.
NightOwl was initially introduced in 2018 as a third-party software to fix the lack of an automated switching capability, and it quickly attracted a user base. However, with the release of official macOS dark mode capabilities, the app became outdated.
It was recently discovered that NightOwl had been stealthily upgraded to add malicious code that transformed users' devices into botnet agents. The app turned out to be operating a local HTTP proxy without the users' knowledge or consent, transferring their IP data through a server network.The app's settings could not be disabled, forcing users to enter commands in the Terminal app to delete the code from their devices.
Due to the removal of the app from the NightOwl website and app store, it is unclear how many individuals were impacted by this criminal activity. The app's website says that over 27,000 users have downloaded it more than 141,000 times. The NightOwl proprietors claim that they are cooperating with antivirus firms to swiftly resolve the issue and deny any misconduct.
Taylor Robinson, a web developer who identified the app's nefarious activity, identified that NightOwl was purpose-built to remain anonymous. The botnet connection was created on the device's principal user account and executed every time booted up. The app's owners claimed that they merely collected users' IP addresses and that this was indicated in their terms and conditions.
While there is no proof that more than IP addresses were collected, the app owners went to considerable length to hide their trails. The app's terms of service were amended in June, adding language that required users' computers to act as a gateway for sharing internet traffic with third parties.
The NightOwl app serves as a warning tale for users to be aware of third-party software and to frequently evaluate their installed programmes for any potential privacy or security risks.
