Criminals target new platforms, malware targeting Apple M1 chip emerges

      News on the morning of February 18th revealed that malware specifically targeting Apple's M1 chip has recently appeared, indicating that criminals have begun to target Apple's self-developed chip platform.

　　Mac security researcher Patrick Wardle has now published a report that details how the malware was adapted and recompiled to run on the ‌M1‌ chip platform.

　　Wardle discovered the first known malware for the M1 platform in a Safari ad plug-in. The extension was originally written to run on Intel x86 chips and is called GoSearch22. It is a member of the Pirrit Mac adware family and was first discovered in late December. Pirrit is one of the oldest and most active Mac adware families. And it is known to constantly change to evade detection, so it is not surprising that it has begun to adapt to the ‌M1‌.

　　The GoSearch22 adware disguises itself as a legitimate Safari browser extension but collects user data and delivers banner ads and pop-ups, some of which link to malicious websites.

　　Wardle noted that because the ‌M1‌ malware is still in its early stages, antivirus scanners can't detect it as easily as the x86 version, which defense tools like antivirus engines struggle to handle.

　　Currently only three products, including MacBook Pro, MacBook Air and Mac mini, use Apple's M1 chip, but the technology is expected to expand to other products in the Mac series in the next two years. Therefore, it is inevitable that malware developers will target this future trend.

　　While the M1-native malware discovered by the researchers doesn't appear to be particularly dangerous, there may be more to come.