Wardle uploaded samples of both to VirusTotal, and as of this writing, 16 antivirus engines caught the x86-64 version, 14 the ARM64 one. What's more concerning is that while many of the best Mac antivirus programs catch the regular version of GoSearch22, fewer detect the M1-coded version. You do want to make sure it's not on your Mac, however.

But there's no evidence yet that GoSearch22 does steal data or result in more malware being installed on Macs.

One online malware-removal guide notes that GoSearch22 is similar to adware that 'tend to be designed to collect browsing data' and may display ads that can 'download and/or install unwanted apps by executing certain scripts.' 'Its main goal, objective, seems to be related to financial gain via ads, search results, etc.' 'It seems like fairly vanilla adware,' Wardle told Motherboard's Lorenzo Franceschi-Bicchierai. And it's a fat binary with code for both x86-64 and ARM64 chips, indicating it was created to run on Macs rather than iOS devices. It's a derivation of the older Pirrit adware, first spotted in 2016 and still plaguing Macs. He got more than 200 results, but most were for iOS jailbreaking software that was built to run on both older and newer iPhone/iPad chips. So he searched in the online VirusTotal database for malware that met all the right parameters.Īmong other things, it had to be written for macOS or iOS, contain ARM64 instructions, support more than one chip architecture, be digitally 'signed' by an Apple developer and be detected as malware by at least two antivirus engines. Wardle wondered if any known malware was secretly using fat binaries that hadn't yet been spotted.

Adware cleaner mac chip