The latest OSX/Adload variants arrive via an OSX/Bundlore Trojan horse, which generally masquerades as an installer mimicking the icon art style of Adobe Flash Player, and continues to claim to be Flash Player during the installation process.Īn OSX/Bundlore fake Adobe Flash Player installer, which actually installs OSX/Adload.

Read on for more details on this latest Mac malware threat.

However, Apple’s XProtect definitions built into macOS did not detect much of this malware until several months after it had already been infecting Macs. Intego VirusBarrier X9 detects files from this Adload campaign as OSX/Adload and OSX/Bundlore.zsh. It typically consists of a Trojan horse dropper app, often disguised as a Flash Player installer, which installs a LaunchAgent or LaunchDaemon as a method of persistence (so the malware can continue to infect the Mac whenever it gets powered on or restarted). In recent weeks, there has been increased awareness of a common Mac malware campaign dubbed Adload. Malware OSX/Adload: Mac Malware Apple Missed for Many Months

Flash downloader mac