{"id":94290,"date":"2021-08-26T15:32:23","date_gmt":"2021-08-26T22:32:23","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=94290"},"modified":"2021-09-24T08:31:04","modified_gmt":"2021-09-24T15:31:04","slug":"osx-adload-mac-malware-apple-missed-for-many-months","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/osx-adload-mac-malware-apple-missed-for-many-months\/","title":{"rendered":"OSX\/Adload: Mac Malware Apple Missed for Many Months"},"content":{"rendered":"

\"\"<\/p>\n

In recent weeks, there has been increased awareness of a common Mac malware campaign dubbed Adload<\/strong>. It typically consists of a Trojan horse dropper app, often disguised as a Flash Player installer, which installs a LaunchAgent or LaunchDaemon as a method of persistence (so the malware can continue to infect the Mac whenever it gets powered on or restarted).<\/p>\n

Intego VirusBarrier X9 detects files from this Adload campaign as OSX\/Adload<\/strong>\u00a0and OSX\/Bundlore.zsh<\/strong>. However, Apple’s XProtect definitions built into macOS did not detect much of this malware until several months after it had already been infecting Macs.<\/p>\n

Read on for more details on this latest Mac malware threat.<\/p>\n

How does Adload malware spread?<\/h3>\n

The latest OSX\/Adload variants arrive via an OSX\/Bundlore Trojan horse, which generally masquerades as an installer mimicking the icon art style of Adobe Flash Player, and continues to claim to be Flash Player during the installation process.<\/p>\n

\"OSX\/Adload

An OSX\/Bundlore fake Adobe Flash Player installer, which actually installs OSX\/Adload. (Image: Intego)<\/p><\/div>\n

Most often, such Trojan horses are unintentionally encountered when a victim visits a malicious link, or a compromised (hacked) site that automatically redirects to a malicious download. In some cases, poisoned search results on Google or other search engines may lead to such malware.<\/p>\n

Why does malware still pretend to be Flash Player?<\/h3>\n

Adobe Flash Player officially ended security updates on December 31, 2020<\/a>, but that hasn’t stopped malware makers from disguising their Trojan horses as Flash installers.<\/p>\n

The reality is, however, that most non-geeks are unaware that Flash is past its end of life. At one point in Flash Player’s history, installing urgent Flash updates became an almost weekly occurrence, as new zero-day exploits for the bug-riddled software were found routinely.<\/p>\n

Old habits die hard, and many users have come to expect that they need to update Flash whenever they’re prompted to. For some, it has become an almost Pavlovian response\u2014and that seems to be what malware makers are banking on.<\/p>\n

As further discussed in:<\/em><\/p>\n

Adobe Flash Player is dead, yet 10% of Macs are infected with fake Flash malware<\/a><\/p><\/blockquote>\n