New Variant of UpdateAgent Malware Infects Mac Computers with Adware

Microsoft on Wednesday shed light on a previously undocumented
Mac trojan that it said has underwent several iterations since its
first appearance in September 2020, effectively granting it an
“increasing progression of sophisticated capabilities.”

The company’s Microsoft 365 Defender Threat Intelligence Team
dubbed the new malware family “UpdateAgent,”
charting its evolution from a barebones information stealer to a
second-stage payload distributor as part of multiple attack waves
observed in 2021.

“The latest campaign saw the malware installing the evasive and
persistent Adload adware, but UpdateAgent’s ability to gain access
to a device can theoretically be further leveraged to fetch other,
potentially more dangerous payloads,” the researchers said^[1].

The actively in-development malware is said to be propagated via
drive-by downloads or advertisement pop-ups that masquerade as
legitimate software like video applications and support agents,
even as the authors have made steady improvements that have
transformed UpdateAgent into a progressively persistent piece of
malware.

Chief among the advancements include the capability to abuse
existing user permissions to surreptitiously perform malicious
activities and circumvent macOS Gatekeeper^[2]
controls, a security feature that ensures only trusted applications
from identified developers can be installed on a system.

In addition, UpdateAgent has been found to take advantage of
public cloud infrastructure, namely Amazon S3 and CloudFront
services, to host its second-stage payloads, including adware, in
the form of .DMG or .ZIP files.

Once installed, the Adload malware makes use of ad injection
software and man-in-the-middle (MitM^[3]) techniques to intercept
and reroute users’ internet traffic through the attacker’s servers
to insert rogue ads into web pages and search engine results to
increase the chances of multiple infections on the devices.

“UpdateAgent is uniquely characterized by its gradual upgrading
of persistence techniques, a key feature that indicates this trojan
will likely continue to use more sophisticated techniques in future
campaigns,” the researchers cautioned.