In late 2020 a new strain of malware called UpdateAgent appeared and began infecting Mac users.
Initially the strain wasn’t all that worrisome. It stole system information but it was by no means the worst threat on a Mac user’s radar.
Since that time, the hackers behind the malicious code have been busy. UpdateAgent has received a few developments, with each one adding a new element of danger to the equation. As things stand now UpdateAgent should be considered a serious threat to Mac users.
As of its latest iteration UpdateAgent installs an annoyingly persistent adware strain called Adload. It has gained capabilities that make it easy for UpdateAgent to install other even more threatening and damaging payloads in the future.
Microsoft has been investigating and following the development of UpdateAgent. The company has discovered that the hackers who created the strain are hosting a wide range of other payloads on Amazon Web Services’ S3 and CloudFront services. While these have not yet been tied to UpdateAgent, it’s a clear sign of the shape of things to come.
In addition to that, the code is now capable of fetching compressed zip files instead of .dmg files. It has been modified to prevent Gatekeeper from displaying pop-up warnings to users. It can also inject persistent code inside background processes that are invisible to the user.
Microsoft had this to say about their study of the malware strain:
“UpdateAgent is uniquely characterized by its gradual upgrading of persistence techniques, a key feature that indicates this trojan will likely continue to use more sophisticated techniques in future campaigns.
Like many information-stealers found on other platforms, the malware attempts to infiltrate macOS machines to steal data and it is associated with other types of malicious payloads, increasing the chances of multiple infections on a device.”
If UpdateAgent wasn’t on your radar before it certainly belongs there now. It’s one to watch out for in the year ahead.
