AdLoad – A Mac Malware That Has Punched Through Apple’s Gatekeeper and XProtect

As per security research firm Sentinel One, a notorious Mac Malware has resurfaced. And, it is more dangerous than ever as it is also able to invade Mac’s lines of defense – Gatekeeper, and XProtect. More than 150 strains of AdLoad have been observed ever since November 2020. Although there has been a steep rise in the strains especially in July and August 2021.

🔥 New on SentinelLabs! #AdLoad is a common #adware threat afflicting #macOS , undetected by #apple‘s XProtect. Learn how to detect this widespread browser hijacker, its infection pattern, and indicators of compromise. By @philofishal https://t.co/4k3zJBOUFy#infosec #security

— SentinelOne (@SentinelOne) August 11, 2021

In this blog, we’ll discuss the AdLoad Malware in greater detail, and not just that we will even have a look at some preventive steps, you can take to keep AdLoad malware at bay.

What is AdLoad Malware? How Does It Work?

AdLoad is a well-known Trojan that has been troubling Apple for years now. It was first spotted in 2017 and ever since then, it has also been able to deceive Mac’s notarizing defenses as well.

Here is how it works –

It attacks a system by the way of a backdoor and then downloads and installs PUPs (potentially unwanted programs) or adware. This malware doesn’t just stop there, it can also steal and transmit information about the infected machine. It then sends the stolen information to the remote servers operated by hackers.

Once AdLoad Malware is installed on a Mac, it installs a Man-In-The-Middle web proxy that further hijacks search engine results. It also injects adware for monetary gains.

Why Is AdLoad Able To Get Past XProtect and Gatekeeper

Many strains of AdLoad Malware can get past Mac’s own Malware XProtect for the simple reason that many AdLoad strains don’t match the malware profiles present in XProtect’s database.

Then, there are new AdLoad malware strains that are signed or notarized by Apple developer certificate and they are, therefore, able to pass Apple’s Gatekeeper

Need of The Hour

Apple needs to add further endpoint security controls to Mac devices, the reason being that there are several hundreds of samples of malware like the ones mentioned above that can get past Apple’s built-in security scanners.

How To Protect Your Mac From AdLoad Malware

Download Anti-Malware for Mac

Apart from just relying on Macs for security measures, you should invest in an Anti-malware utility for Mac.

McAfee Total Protection, for instance, is one of the best Anti-malware utilities for Mac available. It is constantly upgraded with the latest malware database. Therefore, the chances of any malware deceiving it are next to none.

McAfee Total Protection– Features

• Protection from various kinds of malware, spyware, and adware
• Thoroughly scans your Mac for critical sections and even selected files and folders
• The database of McAfee Total Protection is updated with the latest malware strains.
• The interface is simple, straightforward, and easy to use.
• Dedicated tools for top-notch web security.
• Comes with a powerful VPN functionality to mask your identity online.

Avoid Downloading Content From Unauthorized Websites

Do not download files, software, or any content from unauthorized websites. You should also avoid downloading any content from peer-to-peer networks. These are the places where hackers upload malicious content and deceive unsuspecting users into downloading such content.

Uninstall Any Recently Installed Apps

In case you notice any apps that you didn’t install, promptly get rid of them. Make sure that no remnants of such apps still loom around in your Mac. We have outlined some very effective ways you can do just that.

Remove AdLoad Agents and Daemons

As SentinelOne researchers have found that AdLoad installs a persistence agent in a user’s Library Launch agents. Here’s how some of them can be removed –

1. Head to the Finder

2. Click on Go > Go to Folder

3. Search for

~/Library/LaunchAgents/com.<label>.service.plist

/Library/LaunchDaemons/com.<label>.system.plist

~/Library/Application\

Support/.[0-9]{19}/Services/com.<label>.service/<label>.service

/Library/Application\

Support/.[0-9]{19}/System/com.<label>.system/<label>.system

4. Right-click on each of these and then click on Move to Trash

Say No To Any Additional Software That Comes Bundled

As we can see, AdLoad installs several PUPs and then adware. So, as a preventive measure, after downloading a file or app, be very careful of the content, and if asked to download additional software, it is best to avoid it.

Wrapping Up

With new strains of Mac malware pouring in, even Apple is struggling to put its best foot forward. The need of the hour is to be extremely careful and take preventive steps such as having an Anti-malware utility and not downloading apps from suspicious and unauthorized sources. If you liked the content, do give it a thumbs up and share it with your friends and family.