"We had originally believed that we would have seen a greater decline in infections at this point in time, but this has proven not to be the case," commented the Symantec researchers who have set up a sinkhole to monitor the botnet's existence but offered no explanation for the unexpected slow decline.
The researchers say that the domains hosting the C&C server for the botnet change every day, and that they are not limited to the .com domain, but will also be set up on .in, .info, .kz and .net top level domains.
They also point out that among the new features of the Trojan is the ability to "retrieve updated C&C locations through Twitter posts by searching for specific hashtags generated by the OSX.Flashback.K hashtag algorithm."
Users who haven't yet installed the latest Java update (for OS X Lion and OS X Snow Leopard) are advised to do so because the Java vulnerability (CVE-2012-0507) misused by Flashback is currently being exploited to install another Mac Trojan called SabPub, and others can crop up at any time.
Reading our newsletter every Monday will keep you up-to-date with security news.
Receive a daily digest of the latest security news.