Malware Infects 1macbook including 30,000 Macs — What to Do Now

Malware Infects 1macbook including 30,000 Macs — What to Do Now

Mysterious new malware has been detected on some 30,000 Mac devices, including Macs equipped with Apple's new M1 chip.

The so-called Silver Sparrow malware was discovered by researchers at security firm Red Canary, who say it poses a "reasonably serious threat" due to its "forward-looking M1 chip compatibility, global reach, relatively high infection rate, and operational maturity." Basically, this is bad news for Macs old and new. [One targets older Intel Macs, the second version targets both Intel-based Macs and news devices running on Apple's newer M1 chips, such as the M1-based MacBook Air and M1-based MacBook Pro, a "fat" binary that adapts to both types of chips.

However, it is not yet clear what Silver Sparrow's purpose actually is. The malware code does not appear to contain a malicious payload and has not yet been confirmed to deliver a malicious payload to any of the infected machines, but instead appears to be waiting for further instructions, researchers said.

"There is no way to know for sure what payloads will be distributed by the malware, whether the payloads have already been distributed and removed, or whether adversaries have a future timeline for distribution," intelligence analyst Tony Lambert stated in a post on the Red Canary blog last week.

It is also not clear how the machines were infected, but researchers explain that they suspect it was via the results of a malicious search engine that led victims to download a specific malicious PKG file.

"We found that many macOS threats are distributed as a single self-contained installer in PKG or DMG format, disguised as a legitimate application such as Adobe Flash Player, or an update, through malicious advertising." stated the researchers. In this case, however, the adversary distributed the malware in two different packages: update.pkg and update.pkg."

What we do know is that it has already been found in 153 countries, with the United States, the United Kingdom, Canada, France, and Germany having the most.

So far, all the Intel-only version of the malware does is display the message "Hello, world!" The "fat" binary, which runs on both Intel and M1 chips, announces "You did it!"

The good news is that Apple has taken action to prevent new infections, confirming to Mashable that it has withdrawn the certificate for the developer account used to digitally "sign" the package.

While this will be of no use to you, one of the 30,000 people already infected with malware, Red Canary has kindly posted a guide to the signs to watch out for.

This is the second piece of malware in the wild known to run natively on Apple's in-house M1 chip. The first, called GoSearch 22, was only discovered last week. It is an adware that hijacks browser search results, inserts ads, and may even steal data.

While it is impossible to completely protect your Mac from malicious software, you can make your Apple device as secure as possible by installing the best Mac antivirus software and using one of the best Mac VPNs.

Categories