Powerful Mac malware can install anything — what you need to do

A previously passive Mac Trojan has become much more dangerous, reports Microsoft.

The computing giant tweeted out last week that Mac malware known as WizardUpdate or UpdateAgent, once purely an "infostealer" that profiled infected systems, had recently evolved so that it could grant itself administrative powers to install other software on a Mac.

• Are Macs really more secure than Windows PCs?
• The best Mac antivirus software
• Plus: MacBook Pro M1 Max is an absolute beast — and a waste for gamers

So far, WizardUpdate seems to be installing only adware, primarily a piece of Mac adware called AdLoad that injects ads into loaded web pages and changes search engine results. But WizardUpdate's powers mean it could just as easily load ransomware or botnet malware.

"Given its history, this Trojan will likely continue to grow in sophistication," Microsoft Security Intelligence said in a series of tweets. "We found the latest UpdateAgent variant impersonating legitimate software and likely being distributed via drive-by downloads."

How to stop WizardUpdate from infecting your Mac

To avoid infection by WizardUpdate, use and install one of the best Mac antivirus programs, which will detect and zap the malware before it does too much damage. You also never want to install software from random sources, even if it's "signed" by an Apple developer and appears to be something familiar, such as Adobe Flash Player. 

When WizardUpdate was first discovered this past January by New York-based ad-verification firm Confiant, it was was posing as a Flash Player installer and was digitally signed by a developer. That's still likely to be the case, although it may also be masquerading as other software too. 

The earliest versions of the malware simply "profiled" infected systems as part of an information-gathering operation, according to Microsoft. Since then, WizardUpdate has evolved in stages, progressively adding more abilities so that it now evades macOS' Gatekeeper protections, downloads other programs, alters system preferences and gives the user profile it has infected full system powers.

In other words, WizardUpdate can now do pretty much whatever it wants on an infected Mac, from installing new programs to fully changing system parameters.

The only silver lining here is that so far, WizardUpdate seems to be mainly installing the AdLoad adware, which is more annoying than it is harmful. Yet because WizardUpdate has such powerful abilities, what it installs could get a lot worse soon.

This story was earlier reported by Bleeping Computer.

• Keep your private info private with a Mac VPN