It turned out that rather than the purpose of ThiefQuest being to extort a ransom, it was actually trying to obtain the data. It was initially thought to be the Mac ransomware – the first such case since 2017, except that it didn’t act like ransomware: it encrypted files but there was no way to prove you had paid a ransom and no way to subsequently unencrypted files. Mac ransomware ThiefQuest / EvilQuest could encrypt your Mac (Updated), was Ransomware spreading on the Mac via pirated software found on a Russian torrent forum. Or you might see a warning that you have been infected with a number of viruses inviting you to use an app such as Advanced Mac Cleaner, Mac Adware Remover or Mac Space Reviver. You might see a pop up suggesting that you don’t have software to open an app, for example, offering to help you locate such an app on the web. Malwarebytes uses the name FakeFileOpener to describe apps that advertise PUPs (Potentially Unwanted Programs). This could be an attempt to run concealed Python or a shell code, for example. These accounted for more than 80% of cases, but rather than being one rampant case of malware, this is Malwarebytes name for any detection that was deemed to be suspicious behaviour.

Based on Pirri and known as GoSearch22 it has been specially compiled for Apple’s ARM platform. There is already adware targetting the M1 Mac. What you need to know about Silver Sparrow Mac malware. It is unclear how many of these are M1 Macs.

But worryingly, according to Malwarebytes, Silver Sparrow has already infected 29,139 macOS systems in 153 countries, most of the infected Macs are in the US, UK, Canada, France and Germany. The malware is dubbed Silver Sparrow, and uses the macOS Installer Javascript API to execute commands.Īt the time of writing it’s unknown to what extent Silver Sparrow poses a threat. Security firm Red Canary discovered malware targeting Macs equipped with the M1 processor.

Hazard os x image download