A previously passive Mac Trojan has become much more dangerous, reports Microsoft.
The computing giant tweeted out last week that Mac malware known as WizardUpdate or UpdateAgent, once purely an "infostealer" that profiled infected systems, had recently evolved so that it could grant itself administrative powers to install other software on a Mac.
- Are Macs really more secure than Windows PCs?
- The best Mac antivirus software
- Plus: MacBook Pro M1 Max is an absolute beast — and a waste for gamers
So far, WizardUpdate seems to be installing only adware, primarily a piece of Mac adware called AdLoad that injects ads into loaded web pages and changes search engine results. But WizardUpdate's powers mean it could just as easily load ransomware or botnet malware.
"Given its history, this Trojan will likely continue to grow in sophistication," Microsoft Security Intelligence said in a series of tweets. "We found the latest UpdateAgent variant impersonating legitimate software and likely being distributed via drive-by downloads."
We recently discovered the latest variant of a Mac malware tracked as UpdateAgent (aka WizardUpdate) with new persistence and evasion tactics, the latest in a series of upgrades over the past year. Given its history, this Trojan will likely continue to grow in sophistication. pic.twitter.com/pt8nfnwg4vOctober 21, 2021
How to stop WizardUpdate from infecting your Mac
To avoid infection by WizardUpdate, use and install one of the best Mac antivirus programs, which will detect and zap the malware before it does too much damage. You also never want to install software from random sources, even if it's "signed" by an Apple developer and appears to be something familiar, such as Adobe Flash Player.
When WizardUpdate was first discovered this past January by New York-based ad-verification firm Confiant (opens in new tab), it was was posing as a Flash Player installer and was digitally signed by a developer. That's still likely to be the case, although it may also be masquerading as other software too.
The earliest versions of the malware simply "profiled" infected systems as part of an information-gathering operation, according to Microsoft. Since then, WizardUpdate has evolved in stages, progressively adding more abilities so that it now evades macOS' Gatekeeper protections, downloads other programs, alters system preferences and gives the user profile it has infected full system powers.
In other words, WizardUpdate can now do pretty much whatever it wants on an infected Mac, from installing new programs to fully changing system parameters.
The only silver lining here is that so far, WizardUpdate seems to be mainly installing the AdLoad adware, which is more annoying than it is harmful. Yet because WizardUpdate has such powerful abilities, what it installs could get a lot worse soon.
This story was earlier reported by Bleeping Computer (opens in new tab).
- Keep your private info private with a Mac VPN