A domain naming system changing Trojan that targets Apple Macs is spreading disguised as a MacCinema Installer.