Powerful Mac malware can install anything — what you need to do

News
By last updated

It's loading annoying ads for now

Best Laptops 2021: MacBook Pro 2021 (14-inch)
(Image credit: Future)

A previously passive Mac Trojan has become much more dangerous, reports Microsoft.

The computing giant tweeted out last week that Mac malware known as WizardUpdate or UpdateAgent, once purely an "infostealer" that profiled infected systems, had recently evolved so that it could grant itself administrative powers to install other software on a Mac.

So far, WizardUpdate seems to be installing only adware, primarily a piece of Mac adware called AdLoad that injects ads into loaded web pages and changes search engine results. But WizardUpdate's powers mean it could just as easily load ransomware or botnet malware.

"Given its history, this Trojan will likely continue to grow in sophistication," Microsoft Security Intelligence said in a series of tweets. "We found the latest UpdateAgent variant impersonating legitimate software and likely being distributed via drive-by downloads."

How to stop WizardUpdate from infecting your Mac

To avoid infection by WizardUpdate, use and install one of the best Mac antivirus programs, which will detect and zap the malware before it does too much damage. You also never want to install software from random sources, even if it's "signed" by an Apple developer and appears to be something familiar, such as Adobe Flash Player. 

When WizardUpdate was first discovered this past January by New York-based ad-verification firm Confiant, it was was posing as a Flash Player installer and was digitally signed by a developer. That's still likely to be the case, although it may also be masquerading as other software too. 

The earliest versions of the malware simply "profiled" infected systems as part of an information-gathering operation, according to Microsoft. Since then, WizardUpdate has evolved in stages, progressively adding more abilities so that it now evades macOS' Gatekeeper protections, downloads other programs, alters system preferences and gives the user profile it has infected full system powers.

(Image credit: Microsoft)

In other words, WizardUpdate can now do pretty much whatever it wants on an infected Mac, from installing new programs to fully changing system parameters.

The only silver lining here is that so far, WizardUpdate seems to be mainly installing the AdLoad adware, which is more annoying than it is harmful. Yet because WizardUpdate has such powerful abilities, what it installs could get a lot worse soon.

This story was earlier reported by Bleeping Computer.

  • Keep your private info private with a Mac VPN
Paul Wagenseil
Paul Wagenseil

Paul Wagenseil is a senior editor at Tom's Guide focused on security and privacy. He has also been a dishwasher, fry cook, long-haul driver, code monkey and video editor. He's been rooting around in the information-security space for more than 15 years at FoxNews.com, SecurityNewsDaily, TechNewsDaily and Tom's Guide, has presented talks at the ShmooCon, DerbyCon and BSides Las Vegas hacker conferences, shown up in random TV news spots and even moderated a panel discussion at the CEDIA home-technology conference. You can follow his rants on Twitter at @snd_wagenseil.