In a blog post, Russian anti-virus firm Doctor Web said the new Trojan for Mac OS X, "Trojan.SMSSend.3666," targeted Windows users but is setting its sights on OS X only now.
"Trojan.SMSSend programs are found in large numbers on the Internet. These are fake installers available on various sites disguised as distributions of legitimate software," Doctor Web said.
When a user starts the fake installer, he or she will first see the usual interface imitating the installation of an app.
But during the installation, the user will be asked to enter his or her mobile phone number, and then specify the code found in a reply SMS.
"By performing these actions the user agrees to terms of a chargeable subscription and a fee will be debited from their mobile phone account on a regular basis. Such installers usually contain meaningless data or the programs they are supposed to install, which in fact can be downloaded from official sites of their developers free of charge," Doctor Web said.
Doctor Web said the malicious app spreads under the so-called "affiliate program" ZipMonster, adding Trojan.SMSSend.3666 is the first program of its kind that targets Mac OS X.
It advised users to be wary of installers that require them to submit their phone number or send a text message.
"Most likely, you will lose money and end up with nothing. Moreover, you will most likely be able to find the program you want with a search engine and download it free of charge from an official site of its developers," it said.