“Certain defensive tools like antivirus engines struggle to process this 'new' binary file format,” Wardle says. But Wardle found that while VirusTotal's suite of antivirus scanners easily spot the x86-based version of the adware as malicious, there was a 15 percent drop in detection of the M1 version.

The malicious Safari extension does have some anti-analysis features, including logic to try to avoid debugging tools. The malicious extension, GoSearch22, is a member of the notorious Pirrit Mac adware family. Longtime Mac security researcher Patrick Wardle published findings on Wednesday about a Safari adware extension that was originally written to run on Intel x86 chips, but has now been redeveloped specifically for M1. Not to be outdone, malware authors have started making the transition too. That transition has required legitimate developers to work on building versions of their software that run “natively” on M1 for optimal performance rather than needing to be translated through an Apple emulator called Rosetta 2.

Now hackers have debuted malware tailored to run on Apple's new ARM-based M1 processors, released for the MacBook Pro, MacBook Air, and Mac Mini in November.Īpple's M1 chip is a departure from the Intel x86 architecture Apple has used since 2005, and it gives Apple the opportunity to bake specific Mac security protections and features directly into its processors.

There's adware and even ransomware tailored to Macs, and attackers are always looking to circumvent Apple's latest defenses. Mac malware has always been less common than its Windows-targeting counterparts, but in recent years the threat to Apple computers has gone mainstream.

Automator mac virus