{"id":103092,"date":"2025-02-13T12:26:53","date_gmt":"2025-02-13T20:26:53","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=103092"},"modified":"2025-02-13T22:34:34","modified_gmt":"2025-02-14T06:34:34","slug":"intego-discovers-undetected-osx-adload-decompiled-python-adware","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/","title":{"rendered":"Intego discovers undetected OSX\/Adload decompiled Python adware"},"content":{"rendered":"<p><img loading=\"lazy\" class=\"aligncenter wp-image-103111 size-full\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2025\/02\/Mac-macOS-OSX-malware-on-iMac-ghostly-figure-with-python-600x350-1.jpg\" alt=\"Mac malware on an iMac with a ghostly figure and a python, representing OSX\/Adload adware\" width=\"600\" height=\"350\" \/><\/p>\n<p>For the past couple years, there has been a plethora of discussion around <a href=\"https:\/\/www.intego.com\/mac-security-blog\/topic\/stealer-malware\/\">stealer malware that infects Macs<\/a>. But other malware families, and categories of malware including potentially unwanted apps (PUA), remain common on Macs, too. Take, for example, the <strong>OSX\/Adload<\/strong> adware.<\/p>\n<p>We&#8217;ve been discussing Adload on The Mac Security Blog for close to a decade, and it still hasn&#8217;t gone away. Over the past week, our researchers have been taking another look at some recent Adload samples. Here&#8217;s what we&#8217;ve discovered.<\/p>\n<p><em>In this article:<\/em><\/p>\n<ul>\n<li><a href=\"#new\">What&#8217;s new with OSX\/Adload?<\/a><\/li>\n<li><a href=\"#staysafe\">How can I keep my Mac safe from Adload and other adware or malware?<\/a><\/li>\n<li><a href=\"#iocs\">Indicators of compromise (IOCs)<\/a><\/li>\n<li><a href=\"#other-names\">Do security vendors detect this by any other names?<\/a><\/li>\n<li><a style=\"font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen-Sans, Ubuntu, Cantarell, 'Helvetica Neue', sans-serif;\" href=\"#learnmore\">How can I learn more?<\/a><a style=\"font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen-Sans, Ubuntu, Cantarell, 'Helvetica Neue', sans-serif;\" name=\"new\"><\/a><\/li>\n<\/ul>\n<h3>What&#8217;s new with OSX\/Adload?<\/h3>\n<p>Historically, Adload adware has been distributed via Trojan horses. For example, it used to <a href=\"https:\/\/www.intego.com\/mac-security-blog\/osx-adload-mac-malware-apple-missed-for-many-months\/\">masquerade as Flash Player installers<\/a>. Later, <a href=\"https:\/\/www.intego.com\/mac-security-blog\/highlights-of-recent-mac-malware-osx-wizardupdate-and-osx-bundlore\/\">UpdateAgent and its successor WizardAgent<\/a> distributed Adload as an additional payload. (See <a href=\"https:\/\/www.intego.com\/mac-security-blog\/?s=adload\">all articles mentioning Adload<\/a>.)<\/p>\n<p>While examining recent variants of OSX\/Adload, we observed that most compiled Mach-O (native Mac executable app) files typically have a detection rate of roughly between one-third to one-half of the antivirus engines on VirusTotal, a multi-engine file scanning site. This is a fairly common detection rate for Mac malware in general. Recent Adload samples are typically self-signed with an ad-hoc signature.<\/p>\n<p>But when assessing Adload&#8217;s decompiled Python code, we noticed that <strong>none of the 60+ engines on VirusTotal detected the decompiled Adload Python sample<\/strong> (see the <code>6eb4433f\u2026<\/code> file in the <a href=\"#iocs\">IOCs section<\/a> below). To be clear, that doesn&#8217;t necessarily mean that <em>all<\/em> other antivirus products, when actively running on end-user systems, won&#8217;t detect the malicious code upon execution; but it does imply that, at least as configured per vendor requests, VirusTotal&#8217;s implementation of those engines doesn&#8217;t detect the static file.<\/p>\n<p>Furthermore, <strong>only one of the 96 domain reputation tools that VirusTotal uses<\/strong> detects the infection vector site&#8217;s domain (<code>m.advancedsprint[.]com<\/code>)\u2014both the subdomain and its parent domain\u2014as malicious.<\/p>\n<p>This suggests that, with little effort from the adware&#8217;s developers or distributors, OSX\/Adload may be able to infect many Macs\u2014potentially even if they have certain popular third-party antivirus software installed.<\/p>\n<p>That underscores the need for users to remain vigilant when downloading apps online; even <a href=\"https:\/\/www.intego.com\/mac-security-blog\/cuckoo-returns-mac-malware-spreads-via-legit-looking-google-ads\/\">clicking on links in Google results often leads to malware<\/a>. Using a trusted, Mac-focused anti-malware suite\u2014like Intego&#8217;s Mac Premium Bundle, which includes VirusBarrier\u2014is also an essential part of keeping your Mac safe from harmful files and potentially dangerous software.<a name=\"staysafe\"><\/a><\/p>\n<h3>How can I keep my Mac safe from Adload and other adware or malware?<\/h3>\n<p>If you use Intego VirusBarrier, you&#8217;re already protected from this adware. Intego detects these samples as <strong>OSX\/Adload.ext<\/strong> and <strong>Python\/Adload<\/strong>.<\/p>\n<p><img loading=\"lazy\" class=\"alignright size-medium wp-image-54214\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2016\/06\/X9-Mac-Antivirus-Launch-300x150.png\" alt=\"Intego X9 software boxes\" width=\"200\" height=\"100\" srcset=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2016\/06\/X9-Mac-Antivirus-Launch-300x150.png 300w, https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2016\/06\/X9-Mac-Antivirus-Launch-150x75.png 150w, https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2016\/06\/X9-Mac-Antivirus-Launch.png 600w\" sizes=\"(max-width: 200px) 100vw, 200px\" \/>Intego VirusBarrier X9, included with <strong><a href=\"https:\/\/offer.intego.com\/BlogMACAV_lbmxlkchf\">Intego&#8217;s Mac Premium Bundle X9<\/a><\/strong>, is a powerful solution designed to protect against, detect, and eliminate Mac malware.<\/p>\n<p>If you believe your Mac may be infected, or to prevent future infections, it&#8217;s best to use antivirus software from a trusted Mac developer. VirusBarrier is award-winning antivirus software, designed by Mac security experts, that includes <a href=\"https:\/\/www.intego.com\/mac-security-blog\/why-your-antivirus-needs-real-time-scanning\/\">real-time protection<\/a>. It runs natively on both Intel- and Apple silicon-based Macs, and it&#8217;s compatible with Apple&#8217;s current Mac operating system, macOS Sequoia.<\/p>\n<p>One of VirusBarrier&#8217;s unique features is that it can <a href=\"https:\/\/support.intego.com\/hc\/en-us\/articles\/207114798-VirusBarrier-X9-How-to-Scan-iPhone-iPad-and-iPod-Touch\">scan for malicious files on an iPhone, iPad, or iPod touch<\/a> in user-accessible areas of the device. To get started, just attach your iOS or iPadOS device to your Mac via a USB cable and open VirusBarrier.<\/p>\n<p>If you use a Windows PC, <a href=\"https:\/\/www.intego.com\/lp\/route-podcast-intego\/?channel=Podcast_Intego&amp;lpx=buy\"><strong>Intego Antivirus for Windows<\/strong><\/a> can keep your computer protected from malware.<a name=\"iocs\"><\/a><\/p>\n<h3>Indicators of compromise (IOCs)<\/h3>\n<p>Following are SHA-256 hashes of adware samples related to this OSX\/Adload campaign:<\/p>\n<pre>6eb4433f1eac5a0c018d5c7299b0f1bef08e2c1620d2d5588335a06560be51fc*\r\nc5a87badff4431f4df2461fe8137e7d705432e122ed4119c9d9bd5850e87ad39*\r\n986fd59d79727ee5f9144fc49ba5e680f7211fd2c555f9e05a0d90b988effa2f\u00b0\r\n0455b08439cd4d4283865f3120000338d9920aa95e88448dcd3b493cc0720b10\r\n11f0074ed041d32a56a5599ecb924f4ad87fd3b5c38be799aaa9b8944d6f5656\r\n134f9d27cf66bc7fde695e5a213fc13fbc327d1f4e977a517b24ef5459d15c9c\r\n15c2270a2261d76d86931853850d2d37d69fdd98cf6a3426a325f5e8eb98478c\r\n2fda25afec552d39a44764956ae96cf445bfcbd489791cde67dbb4b98f960522\r\n364a8eb56a6f85c958ff84ebae61832453929b4aa12b7a75ea2e35301dfd502d\r\n40ecfe9ebdb0156ebe1080ffdcba74c45f8e991da20ad887d5b65fe2b5168cdf\r\n46a79a9200fb6dd802191d4bfbd98142d13e7edae467cdab72a46d1a3d90e79a\r\n50e9747da2ef7454c6f9a833a5cc7363f9e34a12650c1eda819d71bc3ed63f4a\r\n51c8d6d866454308c08d602683461dca6930be6dda1e3aabb08e69cc077043d3\r\n5ce77544e39cffbe8963e11ebad66c20ebb52beb122471ba60837b4f27dae90f\r\n6954fcfd89c531c4893cb8c738b61629f5cb4b621f3f1a8c91df8eaeabc49c30\r\n6edfdbfc33e3f0f551052530284c1dde3a8ee3d04ce2ce7b3f75f80ae7c92100\r\n79b8e4d59087d94a5bab759c3d86d08b0310a468fa11e2d087500f6f4434300f\r\n7b15cc6844ad0381ad84604a818b2ce6c77c44018657e8703d050f2c252213e3\r\n7e177745bf37e7dd3e475e448e8c040c2592ac28bb4e5a0ed9cb7feec965d244\r\n893085f25b6629070780e5bff9cd53eb7b3c373f732791dee5cf75fa2fd791a8\r\na3082b85401386229b0bdd621e3b3978883802b47e0fa8b0923f9778d088e622\r\na35368ff999259bc3d795ed1647952989d943ca4317c836a648edf62259ba7e7\r\nafdd2d7036e388273e05a60280315d18e1ea630e048529da7320a83a84e545e9\r\nb356ce8cc620d183032a38b3a532c79afc8067101fd90c319fd268e9cfd15625\r\nbcb4684cf651a197b77f022df50fd9016c52d42adb794701a05305411c998a46\r\ncfa4b3b3536224cf8da11f5c02ea576014d86f37dd52a531dd59362967a832c3\r\nd750d2f68573956325578c23405e7c59951a78aa5cbf1f087a15e7c0399e79d4\r\nddca87fea7e24f7adbe3614de48d371ac28c12bd02b592e6435c395ecacaf821\r\ne1afa4dbad6e9f131986240d9d96d1b4d24e021433711f81398293973e05adf6\r\n\r\n*first detected by Intego; decompiled Python adware\r\n\u00b0still only 2\/60 detection rate on VirusTotal<\/pre>\n<p>This adware campaign has leveraged the following domain as an infection vector:<\/p>\n<pre>m.advancedsprint[.]com\r\n<\/pre>\n<p>Network administrators can check logs to try to identify whether any computers may have attempted to contact the subdomain above, or its parent domain, which could indicate a possible infection.<a name=\"other-names\"><\/a><\/p>\n<h3>Do security vendors detect this by any other names?<\/h3>\n<p>Other antivirus vendors&#8217; names for this Adload adware may include variations similar to the following:<\/p>\n<p><span style=\"font-size: small;\">A Variant Of OSX\/TrojanDownloader.Adload.AE, AdLoad (PUA), Adloadr (PUA), Adware:MacOS\/Adload.D!MTB, Adware:MacOS\/Multiverze, Adware.ADWARE\/AVA.Agent.rhafu, Adware.ADWARE\/OSX.AVI.Adload.rajvu, Adware.MAC.AdLoad.AQF (B), Adware.MAC.Agent.BG (B), Adware.Mac.Cimpli.10, Adware.OSX.Adload.2!c, Adware.OSX.Agent.2!c, Adware.OSX.Cimpli.2!c, Adware\/Adload!OSX, ADWARE\/AVA.Agent.rhafu, Adware\/Cimpli!OSX, Adware\/OSX.Adload.d, ADWARE\/OSX.AVI.Adload.rajvu, Downloader.AdLoad\/OSX!1.D942 (CLASSIC), Gen:Variant.Adware.MAC.Adload.15 (B), Gen:Variant.Adware.MAC.Lador.1 (B), Gen:Variant.Application.MAC.Adload.8 (B), HEUR:Trojan-Downloader.OSX.AdLoad.gen, HEUR:Trojan-Downloader.OSX.Agent.ab, HEUR:Trojan-Downloader.OSX.Lador.a, HEUR:Trojan-Downloader.Python.Agent.af, HEUR:Trojan-Dropper.OSX.Agent.s, Linux.Siggen.5031, Mac.DownLoad.11, Mac.Trojan.AdLoad.4, Macho.adware.adload, Macho.downloader.adload, Macho.trojan.adload, Macho.unknown.adload, MacOffers, macOS:Adload-AM [Trj], MacOS:Adload-AX [Adw], MacOS:Adload-CV [Drp], MacOS:Agent-AHI [Trj], MacOS:Agent-MX [Trj], MacOS:Agent-PP [Adw], MacOS:Downloader-BS [Drp], MacOS\/Adload.A.gen!Camelot, MacOS\/Agent.A.gen!Camelot, MacOS\/Agent.B.gen!Camelot, Malware.OSX\/Adload.jleie, Malware.OSX\/Agent.ipwvv, Malware.OSX\/AVI.Adload.avslq, Malware.OSX\/AVI.Agent.gczrk, Malware.OSX\/AVI.Downloader.beswh, Malware.OSX\/Dldr.Adload.ergvp, Malware.OSX\/GM.Adload.OC, Malware.OSX\/GM.Agent.TR, Malware.OSX\/GM.Downloader.TM, MaxOfferDeal, Mughthesec (PUA), Not-a-virus:HEUR:AdWare.OSX.Agent.al, OSX.AdLoad!g1, Osx.Adware.Adload-9885354-2, Osx.AdWare.Agent.Hajl, Osx.Trojan-Downloader.Adload.Anhl, Osx.Trojan-Downloader.Agent.Hjgl, Osx.Trojan-Downloader.Lador.Wimw, Osx.Trojan.Adload.Fflw, Osx.Trojan.Agent.Qwhl, Osx.Trojan.Dldr.Bujl, Osx.Trojan.Gm.Rqil, OSX\/Adload.AX!tr.dldr, OSX\/Agent.BQ!tr, OSX\/Dldr.Adload.pgzct, OSX\/Dwnldr-AASO, OSX\/TrojanDownloader.Adload.AK, Password-Stealer ( 0040f4f11 ), Python:Downloader-AJ [Drp], RDN\/Generic.osx, Static AI &#8211; Malicious Mach-O, Static AI &#8211; Suspicious Mach-O, Trojan-Downloader.OSX.Adload, Trojan-Downloader.OSX.Agent.ad, Trojan:MacOS\/Lador.B!MTB, Trojan:MacOS\/Multiverze, Trojan.Adware.MAC.Adload.22, Trojan.Adware.MAC.Lador.1, Trojan.Application.MAC.Adload.8, Trojan.MAC.Adload.AM (B), Trojan.OSX.Adload.4!c, Trojan.OSX.Agent.4!c, Trojan.OSX.Lador.a!c, Trojan[downloader]:MacOS\/Adload.AH, TrojanDownloader:MacOS\/Adload.B!MTB, TrojanDownloader:MacOS\/SAgnt.C!MTB, TrojanDropper:MacOS\/Lador.K!MTB, Unix.Malware.Lador-9884300-0, Unix.Malware.Macos-9882334-0, Win32.Trojan-Downloader.Agent.Edhl<\/span><a name=\"learnmore\"><\/a><\/p>\n<h3>How can I learn more?<\/h3>\n<p>Be sure to also check out our <a href=\"https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/#forecast\">2025 Apple malware forecast<\/a> and our previous <a href=\"https:\/\/www.intego.com\/mac-security-blog\/category\/malware\/\">Mac malware articles<\/a> from 2025 and earlier.<\/p>\n<p><a href=\"https:\/\/podcast.intego.com\/\" target=\"_blank\" rel=\"noopener\"><img class=\"alignleft\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2021\/04\/intego-podcast-artwork-400.jpg\" alt=\"\" width=\"80\" \/><\/a>Each week on the <a href=\"https:\/\/podcast.intego.com\/\" target=\"_blank\" rel=\"noopener\"><strong>Intego Mac Podcast<\/strong><\/a>, Intego&#8217;s Mac security experts discuss the latest Apple news, including security and privacy stories, and offer practical advice on getting the most out of your Apple devices. Be sure to <a href=\"https:\/\/podcasts.apple.com\/us\/podcast\/intego-mac-podcast\/id1293834627\" rel=\"noopener\"><strong>follow the podcast<\/strong><\/a> to make sure you don\u2019t miss any episodes.<\/p>\n<p>You can also subscribe to our <a href=\"https:\/\/www.intego.com\/mac-security-blog\/mac-security-newsletter\/\"><strong>e-mail newsletter<\/strong><\/a> and keep an eye here on <a href=\"https:\/\/www.intego.com\/mac-security-blog\"><strong>The Mac Security Blog<\/strong><\/a> for the latest Apple security and privacy news. And don&#8217;t forget to follow Intego on your favorite social media channels: <a href=\"https:\/\/x.com\/IntegoSecurity\" target=\"_blank\" rel=\"noopener\"><img style=\"border-width: 1px; border-style: solid; border-color: rgba(255, 255, 255, 0.2); border-radius: 8px;\" title=\"Follow Intego on \ud835\udd4f\/Twitter\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/X-Twitter-logo-icon-225.gif\" alt=\"Follow Intego on X\/Twitter\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/www.facebook.com\/Intego\" target=\"_blank\" rel=\"noopener\"><img style=\"border-width: 1px; border-style: solid; border-color: rgba(255, 255, 255, 0.2); border-radius: 8px;\" title=\"Follow Intego on Facebook\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/Facebook-logo-icon-225.gif\" alt=\"Follow Intego on Facebook\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/www.youtube.com\/user\/IntegoVideo?sub_confirmation=1\" target=\"_blank\" rel=\"noopener\"><img style=\"border-width: 1px; border-style: solid; border-color: rgba(0, 0, 0, 0.2); border-radius: 8px;\" title=\"Follow Intego on YouTube\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/YouTube-logo-icon-225.png\" alt=\"Follow Intego on YouTube\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/www.pinterest.com\/intego\/\" target=\"_blank\" rel=\"noopener\"><img style=\"border-width: 1px; border-style: solid; border-color: rgba(0, 0, 0, 0.2); border-radius: 8px;\" title=\"Follow Intego on Pinterest\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/Pinterest-logo-icon-225.png\" alt=\"Follow Intego on Pinterest\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/www.linkedin.com\/company\/intego\" target=\"_blank\" rel=\"noopener\"><img style=\"border-width: 1px; border-style: solid; border-color: rgba(255, 255, 255, 0.2); border-radius: 8px;\" title=\"Follow Intego on LinkedIn\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/LinkedIn-logo-icon-225.gif\" alt=\"Follow Intego on LinkedIn\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/www.instagram.com\/intego_security\/\" target=\"_blank\" rel=\"noopener\"><img style=\"border-width: 1px; border-style: solid; border-color: rgba(255, 255, 255, 0.2); border-radius: 8px;\" title=\"Follow Intego on Instagram\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/Instagram-logo-icon-225.gif\" alt=\"Follow Intego on Instagram\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/podcasts.apple.com\/us\/podcast\/intego-mac-podcast\/id1293834627\" target=\"_blank\" rel=\"noopener\"><img style=\"border-width: 1px; border-style: solid; border-color: rgba(255, 255, 255, 0.2); border-radius: 8px;\" title=\"Follow the Intego Mac Podcast on Apple Podcasts\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2017\/10\/ios9-podcasts-app-tile.png\" alt=\"Follow the Intego Mac Podcast on Apple Podcasts\" width=\"16\" \/><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Intego\u2019s malware research team has taken a closer look at OSX\/Adload adware samples, and found that decompiled Python scripts seem to be undetected by most antivirus vendors.<\/p>\n","protected":false},"author":14,"featured_media":103113,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false},"categories":[190],"tags":[86,4625],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v17.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<meta name=\"description\" content=\"Intego\u2019s malware research team has taken a closer look at OSX\/Adload adware samples, and found that decompiled Python scripts seem to be undetected by most antivirus vendors.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Intego discovers undetected OSX\/Adload decompiled Python adware - The Mac Security Blog\" \/>\n<meta property=\"og:description\" content=\"Intego\u2019s malware research team has taken a closer look at OSX\/Adload adware samples, and found that decompiled Python scripts seem to be undetected by most antivirus vendors.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/\" \/>\n<meta property=\"og:site_name\" content=\"The Mac Security Blog\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/JoshLong\" \/>\n<meta property=\"article:published_time\" content=\"2025-02-13T20:26:53+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-02-14T06:34:34+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2025\/02\/Mac-macOS-OSX-malware-on-iMac-ghostly-figure-with-python-400x260-1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"400\" \/>\n\t<meta property=\"og:image:height\" content=\"260\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@theJoshMeister\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Joshua Long\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#organization\",\"name\":\"Intego\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/\",\"sameAs\":[],\"logo\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#logo\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png\",\"contentUrl\":\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png\",\"width\":875,\"height\":875,\"caption\":\"Intego\"},\"image\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#logo\"}},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#website\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/\",\"name\":\"The Mac Security Blog\",\"description\":\"Keep Macs safe from the dangers of the Internet\",\"publisher\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.intego.com\/mac-security-blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#primaryimage\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2025\/02\/Mac-macOS-OSX-malware-on-iMac-ghostly-figure-with-python-400x260-1.jpg\",\"contentUrl\":\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2025\/02\/Mac-macOS-OSX-malware-on-iMac-ghostly-figure-with-python-400x260-1.jpg\",\"width\":400,\"height\":260,\"caption\":\"Mac macOS OSX malware on iMac with ghostly figure and python Adload\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#webpage\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/\",\"name\":\"Intego discovers undetected OSX\/Adload decompiled Python adware - The Mac Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#primaryimage\"},\"datePublished\":\"2025-02-13T20:26:53+00:00\",\"dateModified\":\"2025-02-14T06:34:34+00:00\",\"description\":\"Intego\\u2019s malware research team has taken a closer look at OSX\/Adload adware samples, and found that decompiled Python scripts seem to be undetected by most antivirus vendors.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.intego.com\/mac-security-blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Intego discovers undetected OSX\/Adload decompiled Python adware\"}]},{\"@type\":\"Article\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#webpage\"},\"author\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/dcf592275ba6edde8d20f1e60029c6b1\"},\"headline\":\"Intego discovers undetected OSX\/Adload decompiled Python adware\",\"datePublished\":\"2025-02-13T20:26:53+00:00\",\"dateModified\":\"2025-02-14T06:34:34+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#webpage\"},\"wordCount\":1183,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2025\/02\/Mac-macOS-OSX-malware-on-iMac-ghostly-figure-with-python-400x260-1.jpg\",\"keywords\":[\"Malware\",\"OSX\/Adload\"],\"articleSection\":[\"Malware\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#respond\"]}]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/dcf592275ba6edde8d20f1e60029c6b1\",\"name\":\"Joshua Long\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#personlogo\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/5ad29f4111ce14911abaa98cbbcdea42?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/5ad29f4111ce14911abaa98cbbcdea42?s=96&d=mm&r=g\",\"caption\":\"Joshua Long\"},\"description\":\"Joshua Long (@theJoshMeister), formerly Intego\\u2019s Chief Security Analyst, is a renowned security researcher and writer, and an award-winning public speaker. Josh has a master\\u2019s degree in IT concentrating in Internet Security and has taken doctorate-level coursework in Information Security. Apple has publicly acknowledged Josh for discovering an Apple\\u00a0ID authentication vulnerability. Josh has conducted cybersecurity research for well over 25 years, which is often featured by major news outlets worldwide. Keep up with Josh via X\/Twitter, LinkedIn, Facebook, Instagram, YouTube, Patreon, Mastodon, the JoshMeister on Security, and more. \\u2014\",\"sameAs\":[\"https:\/\/security.thejoshmeister.com\",\"https:\/\/www.facebook.com\/JoshLong\",\"https:\/\/www.instagram.com\/thejoshmeister\/\",\"https:\/\/www.linkedin.com\/in\/thejoshmeister\",\"https:\/\/www.pinterest.com\/thejoshmeister\/\",\"https:\/\/twitter.com\/theJoshMeister\",\"https:\/\/www.youtube.com\/@theJoshMeister\"],\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/author\/joshlong\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"description":"Intego\u2019s malware research team has taken a closer look at OSX\/Adload adware samples, and found that decompiled Python scripts seem to be undetected by most antivirus vendors.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/","og_locale":"en_US","og_type":"article","og_title":"Intego discovers undetected OSX\/Adload decompiled Python adware - The Mac Security Blog","og_description":"Intego\u2019s malware research team has taken a closer look at OSX\/Adload adware samples, and found that decompiled Python scripts seem to be undetected by most antivirus vendors.","og_url":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/","og_site_name":"The Mac Security Blog","article_author":"https:\/\/www.facebook.com\/JoshLong","article_published_time":"2025-02-13T20:26:53+00:00","article_modified_time":"2025-02-14T06:34:34+00:00","og_image":[{"width":400,"height":260,"url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2025\/02\/Mac-macOS-OSX-malware-on-iMac-ghostly-figure-with-python-400x260-1.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_creator":"@theJoshMeister","twitter_misc":{"Written by":"Joshua Long","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Organization","@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization","name":"Intego","url":"https:\/\/www.intego.com\/mac-security-blog\/","sameAs":[],"logo":{"@type":"ImageObject","@id":"https:\/\/www.intego.com\/mac-security-blog\/#logo","inLanguage":"en-US","url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png","contentUrl":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png","width":875,"height":875,"caption":"Intego"},"image":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#logo"}},{"@type":"WebSite","@id":"https:\/\/www.intego.com\/mac-security-blog\/#website","url":"https:\/\/www.intego.com\/mac-security-blog\/","name":"The Mac Security Blog","description":"Keep Macs safe from the dangers of the Internet","publisher":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.intego.com\/mac-security-blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"ImageObject","@id":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#primaryimage","inLanguage":"en-US","url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2025\/02\/Mac-macOS-OSX-malware-on-iMac-ghostly-figure-with-python-400x260-1.jpg","contentUrl":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2025\/02\/Mac-macOS-OSX-malware-on-iMac-ghostly-figure-with-python-400x260-1.jpg","width":400,"height":260,"caption":"Mac macOS OSX malware on iMac with ghostly figure and python Adload"},{"@type":"WebPage","@id":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#webpage","url":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/","name":"Intego discovers undetected OSX\/Adload decompiled Python adware - The Mac Security Blog","isPartOf":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#primaryimage"},"datePublished":"2025-02-13T20:26:53+00:00","dateModified":"2025-02-14T06:34:34+00:00","description":"Intego\u2019s malware research team has taken a closer look at OSX\/Adload adware samples, and found that decompiled Python scripts seem to be undetected by most antivirus vendors.","breadcrumb":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.intego.com\/mac-security-blog\/"},{"@type":"ListItem","position":2,"name":"Intego discovers undetected OSX\/Adload decompiled Python adware"}]},{"@type":"Article","@id":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#article","isPartOf":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#webpage"},"author":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/dcf592275ba6edde8d20f1e60029c6b1"},"headline":"Intego discovers undetected OSX\/Adload decompiled Python adware","datePublished":"2025-02-13T20:26:53+00:00","dateModified":"2025-02-14T06:34:34+00:00","mainEntityOfPage":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#webpage"},"wordCount":1183,"commentCount":0,"publisher":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization"},"image":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#primaryimage"},"thumbnailUrl":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2025\/02\/Mac-macOS-OSX-malware-on-iMac-ghostly-figure-with-python-400x260-1.jpg","keywords":["Malware","OSX\/Adload"],"articleSection":["Malware"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#respond"]}]},{"@type":"Person","@id":"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/dcf592275ba6edde8d20f1e60029c6b1","name":"Joshua Long","image":{"@type":"ImageObject","@id":"https:\/\/www.intego.com\/mac-security-blog\/#personlogo","inLanguage":"en-US","url":"https:\/\/secure.gravatar.com\/avatar\/5ad29f4111ce14911abaa98cbbcdea42?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/5ad29f4111ce14911abaa98cbbcdea42?s=96&d=mm&r=g","caption":"Joshua Long"},"description":"Joshua Long (@theJoshMeister), formerly Intego\u2019s Chief Security Analyst, is a renowned security researcher and writer, and an award-winning public speaker. Josh has a master\u2019s degree in IT concentrating in Internet Security and has taken doctorate-level coursework in Information Security. Apple has publicly acknowledged Josh for discovering an Apple\u00a0ID authentication vulnerability. Josh has conducted cybersecurity research for well over 25 years, which is often featured by major news outlets worldwide. Keep up with Josh via X\/Twitter, LinkedIn, Facebook, Instagram, YouTube, Patreon, Mastodon, the JoshMeister on Security, and more. \u2014","sameAs":["https:\/\/security.thejoshmeister.com","https:\/\/www.facebook.com\/JoshLong","https:\/\/www.instagram.com\/thejoshmeister\/","https:\/\/www.linkedin.com\/in\/thejoshmeister","https:\/\/www.pinterest.com\/thejoshmeister\/","https:\/\/twitter.com\/theJoshMeister","https:\/\/www.youtube.com\/@theJoshMeister"],"url":"https:\/\/www.intego.com\/mac-security-blog\/author\/joshlong\/"}]}},"jetpack_featured_media_url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2025\/02\/Mac-macOS-OSX-malware-on-iMac-ghostly-figure-with-python-400x260-1.jpg","jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p4VAYd-qOM","amp_enabled":true,"_links":{"self":[{"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/103092"}],"collection":[{"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/users\/14"}],"replies":[{"embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/comments?post=103092"}],"version-history":[{"count":12,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/103092\/revisions"}],"predecessor-version":[{"id":103118,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/103092\/revisions\/103118"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/media\/103113"}],"wp:attachment":[{"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/media?parent=103092"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/categories?post=103092"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/tags?post=103092"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}