A new malware specifically created to run on Apple's M1 chip, discovered by security researchers, suggests that malware creators have begun adapting malware for Apple 's new generation of Macs , which feature Apple Silicon.
Mac security researcher Patrick Wardlehas published a reportdetailing how malware began to adapt and compile itself to run natively on the M1 chip.
The first known native malware for the M1, discovered by Wardle, comes in the form of a Safari, originally written to run on Intel x86 chips. The malicious extension, called “GoSearch22“, is a well-known member of the adware and was first detected in late December. Pirrit is one of the oldest and most active Mac adware families and is known to constantly change in an attempt to evade detection ,so it’s no surprise that it has already begun adapting for the M1.
The GoSearch22 adware appears as a legitimate Safari browser extension, but it collects data and displays a large number of ads, including some that link to malicious websites to proliferate more malware. Wardle says the adware was signed with an Apple Developer ID in November, which was intended to further hide the malware, but has since been revoked.
Wardle notes that because the new strain of malware is still in an early stage, antivirus scanners do not detect it as easily as the x86 versions, and defensive tools such as antivirus engines struggle to process the modified files.
Researchers from security firm Red Canary told Wired that other types of native MM1 malware, different from Wardle's findings, have also been found.
Only the MacBook Pro, MacBook Air, and Mac mini feature Apple's new chip right now, but the technology is expected to expand to the entire Mac lineup over the next two years. However, since all new Macs are set to feature Apple's new chip in the near future, it was expected that malicious actors would create malware that would target it.
While the malicious software does not appear to be unusual or particularly dangerous, the appearance of these new cadres serves as a warning that more are likely to come.
Source: MacRumors
