UpdateAgent is a macOS trojan Microsoft has tracked since September 2020 that poses as legitimate software, strips the quarantine flag from what it downloads so Gatekeeper doesn't warn you, and installs Adload adware. If adware appeared after you installed an app from an ad or pop-up, look for unfamiliar LaunchAgents and remove the app that started it.
Last reviewed · 1 source
Also known as: OSX.UpdateAgent, WizardUpdate, Silver Toucan
Microsoft traced UpdateAgent from a basic information stealer in September 2020 to a distributor of second-stage payloads by October 2021. It's usually disguised as legitimate software and spread through ads and pop-ups on malicious sites. Later versions download a second payload from Amazon S3 or CloudFront, remove its quarantine attribute with the xattr command so Gatekeeper doesn't block it, and add a plist to the LaunchAgents folder so it runs at every login; its 2021 campaign installed the Adload adware. Microsoft worked with Amazon Web Services to take the payload URLs down.
Downloads disguised as legitimate software, offered through ads and pop-ups on malicious websites
Fake installers that fetch a second payload from cloud storage
Later versions that remove the quarantine attribute so Gatekeeper never warns
Ads, pop-ups or a changed search engine soon after installing something new
New plist files with random or unfamiliar names in ~/Library/LaunchAgents
An app you installed from an ad or pop-up that you can't account for
Check /Applications and ~/Downloads for apps you installed just before the symptoms started, and delete the ones you don't recognize.
In Terminal, list ~/Library/LaunchAgents and /Library/LaunchAgents with ls -la. Inspect any unfamiliar plist with plutil -p <file>.plist to see what it runs, and delete the ones that point at unfamiliar programs.
Open System Settings › General › Device Management (Privacy & Security › Profiles on macOS 13) and remove profiles you didn't add.
UpdateAgent's 2021 campaign installed Adload. Look for Adload's LaunchAgents and for folders with random names in /Library/Application Support.
Remove unfamiliar extensions from Safari, Chrome and Firefox, and reset the homepage and search engine.
CoreLock's free scan checks startup items and compares files in your Downloads folder against a built-in malware-hash list and 19 YARA rules. It can't promise to find everything manual cleanup missed.
Download software from the Mac App Store or the developer's own site, not from ads or pop-ups
Be wary of apps that tell you to right-click and Open to get past a Gatekeeper warning
Keep macOS updated so Gatekeeper and XProtect stay current
Close pop-ups that claim you need an update; update through System Settings instead
What it can and can't do
UpdateAgent adds a plist to your LaunchAgents folder, which the startup-items check in CoreLock's free scan covers. It can't promise to catch every variant.
Microsoft found it runs /usr/bin/xattr -rc on the payload it downloads, which removes the quarantine attribute. Without that attribute, macOS doesn't show its usual warning and Gatekeeper doesn't block the file. It uses the permissions your user account already has.
Mostly through what it installs: adware, browser extensions you didn't add and new LaunchAgents, soon after installing an app from an ad or pop-up.
Its October 2021 campaign installed the Adload adware, downloaded from Amazon S3 and CloudFront. Microsoft noted its ability to get onto a Mac could be used to fetch more dangerous payloads too.
No. The name is a disguise. Real macOS updates come through System Settings › General › Software Update or the Mac App Store, never from a website.
Free, with no account: the scan checks your Downloads folder against a built-in malware-hash list and 19 YARA rules.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser