The infection doesn't actually occur within Safari. When you click a link, your browser is redirected to a file download. The default behavior in Safari is to u

The infection doesn't actually occur within Safari. When you click a link, your browser is redirected to a file download. The default behavior in Safari is to unpack and run "safe" downloads. So, what happens is: 1. You click a link in Safari 2. The installer package is downloaded 3. Safari unpacks it and executes the installer Note: you are not infected yet 4. The user completes the installer wizard, entering their password along the way 5. The computer is "infected" This sucks, but it's not a drive-by infection. Yet. Chrome does not unpack and run downloads, so you'd have to execute the downloaded package yourself.