{"id":103092,"date":"2025-02-13T12:26:53","date_gmt":"2025-02-13T20:26:53","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=103092"},"modified":"2025-02-13T22:34:34","modified_gmt":"2025-02-14T06:34:34","slug":"intego-discovers-undetected-osx-adload-decompiled-python-adware","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/","title":{"rendered":"Intego discovers undetected OSX\/Adload decompiled Python adware"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-103111 size-full\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2025\/02\/Mac-macOS-OSX-malware-on-iMac-ghostly-figure-with-python-600x350-1.jpg\" alt=\"Mac malware on an iMac with a ghostly figure and a python, representing OSX\/Adload adware\" width=\"600\" height=\"350\" \/><\/p>\n<p>For the past couple years, there has been a plethora of discussion around <a href=\"https:\/\/www.intego.com\/mac-security-blog\/topic\/stealer-malware\/\">stealer malware that infects Macs<\/a>. But other malware families, and categories of malware including potentially unwanted apps (PUA), remain common on Macs, too. Take, for example, the <strong>OSX\/Adload<\/strong> adware.<\/p>\n<p>We&#8217;ve been discussing Adload on The Mac Security Blog for close to a decade, and it still hasn&#8217;t gone away. Over the past week, our researchers have been taking another look at some recent Adload samples. Here&#8217;s what we&#8217;ve discovered.<\/p>\n<p><em>In this article:<\/em><\/p>\n<ul>\n<li><a href=\"#new\">What&#8217;s new with OSX\/Adload?<\/a><\/li>\n<li><a href=\"#staysafe\">How can I keep my Mac safe from Adload and other adware or malware?<\/a><\/li>\n<li><a href=\"#iocs\">Indicators of compromise (IOCs)<\/a><\/li>\n<li><a href=\"#other-names\">Do security vendors detect this by any other names?<\/a><\/li>\n<li><a style=\"font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen-Sans, Ubuntu, Cantarell, 'Helvetica Neue', sans-serif;\" href=\"#learnmore\">How can I learn more?<\/a><a style=\"font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen-Sans, Ubuntu, Cantarell, 'Helvetica Neue', sans-serif;\" name=\"new\"><\/a><\/li>\n<\/ul>\n<h3>What&#8217;s new with OSX\/Adload?<\/h3>\n<p>Historically, Adload adware has been distributed via Trojan horses. For example, it used to <a href=\"https:\/\/www.intego.com\/mac-security-blog\/osx-adload-mac-malware-apple-missed-for-many-months\/\">masquerade as Flash Player installers<\/a>. Later, <a href=\"https:\/\/www.intego.com\/mac-security-blog\/highlights-of-recent-mac-malware-osx-wizardupdate-and-osx-bundlore\/\">UpdateAgent and its successor WizardAgent<\/a> distributed Adload as an additional payload. (See <a href=\"https:\/\/www.intego.com\/mac-security-blog\/?s=adload\">all articles mentioning Adload<\/a>.)<\/p>\n<p>While examining recent variants of OSX\/Adload, we observed that most compiled Mach-O (native Mac executable app) files typically have a detection rate of roughly between one-third to one-half of the antivirus engines on VirusTotal, a multi-engine file scanning site. This is a fairly common detection rate for Mac malware in general. Recent Adload samples are typically self-signed with an ad-hoc signature.<\/p>\n<p>But when assessing Adload&#8217;s decompiled Python code, we noticed that <strong>none of the 60+ engines on VirusTotal detected the decompiled Adload Python sample<\/strong> (see the <code>6eb4433f\u2026<\/code> file in the <a href=\"#iocs\">IOCs section<\/a> below). To be clear, that doesn&#8217;t necessarily mean that <em>all<\/em> other antivirus products, when actively running on end-user systems, won&#8217;t detect the malicious code upon execution; but it does imply that, at least as configured per vendor requests, VirusTotal&#8217;s implementation of those engines doesn&#8217;t detect the static file.<\/p>\n<p>Furthermore, <strong>only one of the 96 domain reputation tools that VirusTotal uses<\/strong> detects the infection vector site&#8217;s domain (<code>m.advancedsprint[.]com<\/code>)\u2014both the subdomain and its parent domain\u2014as malicious.<\/p>\n<p>This suggests that, with little effort from the adware&#8217;s developers or distributors, OSX\/Adload may be able to infect many Macs\u2014potentially even if they have certain popular third-party antivirus software installed.<\/p>\n<p>That underscores the need for users to remain vigilant when downloading apps online; even <a href=\"https:\/\/www.intego.com\/mac-security-blog\/cuckoo-returns-mac-malware-spreads-via-legit-looking-google-ads\/\">clicking on links in Google results often leads to malware<\/a>. Using a trusted, Mac-focused anti-malware suite\u2014like Intego&#8217;s Mac Premium Bundle, which includes VirusBarrier\u2014is also an essential part of keeping your Mac safe from harmful files and potentially dangerous software.<a name=\"staysafe\"><\/a><\/p>\n<h3>How can I keep my Mac safe from Adload and other adware or malware?<\/h3>\n<p>If you use Intego VirusBarrier, you&#8217;re already protected from this adware. Intego detects these samples as <strong>OSX\/Adload.ext<\/strong> and <strong>Python\/Adload<\/strong>.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignright size-medium wp-image-54214\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2016\/06\/X9-Mac-Antivirus-Launch-300x150.png\" alt=\"Intego X9 software boxes\" width=\"200\" height=\"100\" srcset=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2016\/06\/X9-Mac-Antivirus-Launch-300x150.png 300w, https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2016\/06\/X9-Mac-Antivirus-Launch-150x75.png 150w, https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2016\/06\/X9-Mac-Antivirus-Launch.png 600w\" sizes=\"auto, (max-width: 200px) 100vw, 200px\" \/>Intego VirusBarrier X9, included with <strong><a href=\"https:\/\/offer.intego.com\/BlogMACAV_lbmxlkchf\">Intego&#8217;s Mac Premium Bundle X9<\/a><\/strong>, is a powerful solution designed to protect against, detect, and eliminate Mac malware.<\/p>\n<p>If you believe your Mac may be infected, or to prevent future infections, it&#8217;s best to use antivirus software from a trusted Mac developer. VirusBarrier is award-winning antivirus software, designed by Mac security experts, that includes <a href=\"https:\/\/www.intego.com\/mac-security-blog\/why-your-antivirus-needs-real-time-scanning\/\">real-time protection<\/a>. It runs natively on both Intel- and Apple silicon-based Macs, and it&#8217;s compatible with Apple&#8217;s current Mac operating system, macOS Sequoia.<\/p>\n<p>One of VirusBarrier&#8217;s unique features is that it can <a href=\"https:\/\/support.intego.com\/hc\/en-us\/articles\/207114798-VirusBarrier-X9-How-to-Scan-iPhone-iPad-and-iPod-Touch\">scan for malicious files on an iPhone, iPad, or iPod touch<\/a> in user-accessible areas of the device. To get started, just attach your iOS or iPadOS device to your Mac via a USB cable and open VirusBarrier.<\/p>\n<p>If you use a Windows PC, <a href=\"https:\/\/www.intego.com\/lp\/route-podcast-intego\/?channel=Podcast_Intego&amp;lpx=buy\"><strong>Intego Antivirus for Windows<\/strong><\/a> can keep your computer protected from malware.<a name=\"iocs\"><\/a><\/p>\n<h3>Indicators of compromise (IOCs)<\/h3>\n<p>Following are SHA-256 hashes of adware samples related to this OSX\/Adload campaign:<\/p>\n<pre>6eb4433f1eac5a0c018d5c7299b0f1bef08e2c1620d2d5588335a06560be51fc*\r\nc5a87badff4431f4df2461fe8137e7d705432e122ed4119c9d9bd5850e87ad39*\r\n986fd59d79727ee5f9144fc49ba5e680f7211fd2c555f9e05a0d90b988effa2f\u00b0\r\n0455b08439cd4d4283865f3120000338d9920aa95e88448dcd3b493cc0720b10\r\n11f0074ed041d32a56a5599ecb924f4ad87fd3b5c38be799aaa9b8944d6f5656\r\n134f9d27cf66bc7fde695e5a213fc13fbc327d1f4e977a517b24ef5459d15c9c\r\n15c2270a2261d76d86931853850d2d37d69fdd98cf6a3426a325f5e8eb98478c\r\n2fda25afec552d39a44764956ae96cf445bfcbd489791cde67dbb4b98f960522\r\n364a8eb56a6f85c958ff84ebae61832453929b4aa12b7a75ea2e35301dfd502d\r\n40ecfe9ebdb0156ebe1080ffdcba74c45f8e991da20ad887d5b65fe2b5168cdf\r\n46a79a9200fb6dd802191d4bfbd98142d13e7edae467cdab72a46d1a3d90e79a\r\n50e9747da2ef7454c6f9a833a5cc7363f9e34a12650c1eda819d71bc3ed63f4a\r\n51c8d6d866454308c08d602683461dca6930be6dda1e3aabb08e69cc077043d3\r\n5ce77544e39cffbe8963e11ebad66c20ebb52beb122471ba60837b4f27dae90f\r\n6954fcfd89c531c4893cb8c738b61629f5cb4b621f3f1a8c91df8eaeabc49c30\r\n6edfdbfc33e3f0f551052530284c1dde3a8ee3d04ce2ce7b3f75f80ae7c92100\r\n79b8e4d59087d94a5bab759c3d86d08b0310a468fa11e2d087500f6f4434300f\r\n7b15cc6844ad0381ad84604a818b2ce6c77c44018657e8703d050f2c252213e3\r\n7e177745bf37e7dd3e475e448e8c040c2592ac28bb4e5a0ed9cb7feec965d244\r\n893085f25b6629070780e5bff9cd53eb7b3c373f732791dee5cf75fa2fd791a8\r\na3082b85401386229b0bdd621e3b3978883802b47e0fa8b0923f9778d088e622\r\na35368ff999259bc3d795ed1647952989d943ca4317c836a648edf62259ba7e7\r\nafdd2d7036e388273e05a60280315d18e1ea630e048529da7320a83a84e545e9\r\nb356ce8cc620d183032a38b3a532c79afc8067101fd90c319fd268e9cfd15625\r\nbcb4684cf651a197b77f022df50fd9016c52d42adb794701a05305411c998a46\r\ncfa4b3b3536224cf8da11f5c02ea576014d86f37dd52a531dd59362967a832c3\r\nd750d2f68573956325578c23405e7c59951a78aa5cbf1f087a15e7c0399e79d4\r\nddca87fea7e24f7adbe3614de48d371ac28c12bd02b592e6435c395ecacaf821\r\ne1afa4dbad6e9f131986240d9d96d1b4d24e021433711f81398293973e05adf6\r\n\r\n*first detected by Intego; decompiled Python adware\r\n\u00b0still only 2\/60 detection rate on VirusTotal<\/pre>\n<p>This adware campaign has leveraged the following domain as an infection vector:<\/p>\n<pre>m.advancedsprint[.]com\r\n<\/pre>\n<p>Network administrators can check logs to try to identify whether any computers may have attempted to contact the subdomain above, or its parent domain, which could indicate a possible infection.<a name=\"other-names\"><\/a><\/p>\n<h3>Do security vendors detect this by any other names?<\/h3>\n<p>Other antivirus vendors&#8217; names for this Adload adware may include variations similar to the following:<\/p>\n<p><span style=\"font-size: small;\">A Variant Of OSX\/TrojanDownloader.Adload.AE, AdLoad (PUA), Adloadr (PUA), Adware:MacOS\/Adload.D!MTB, Adware:MacOS\/Multiverze, Adware.ADWARE\/AVA.Agent.rhafu, Adware.ADWARE\/OSX.AVI.Adload.rajvu, Adware.MAC.AdLoad.AQF (B), Adware.MAC.Agent.BG (B), Adware.Mac.Cimpli.10, Adware.OSX.Adload.2!c, Adware.OSX.Agent.2!c, Adware.OSX.Cimpli.2!c, Adware\/Adload!OSX, ADWARE\/AVA.Agent.rhafu, Adware\/Cimpli!OSX, Adware\/OSX.Adload.d, ADWARE\/OSX.AVI.Adload.rajvu, Downloader.AdLoad\/OSX!1.D942 (CLASSIC), Gen:Variant.Adware.MAC.Adload.15 (B), Gen:Variant.Adware.MAC.Lador.1 (B), Gen:Variant.Application.MAC.Adload.8 (B), HEUR:Trojan-Downloader.OSX.AdLoad.gen, HEUR:Trojan-Downloader.OSX.Agent.ab, HEUR:Trojan-Downloader.OSX.Lador.a, HEUR:Trojan-Downloader.Python.Agent.af, HEUR:Trojan-Dropper.OSX.Agent.s, Linux.Siggen.5031, Mac.DownLoad.11, Mac.Trojan.AdLoad.4, Macho.adware.adload, Macho.downloader.adload, Macho.trojan.adload, Macho.unknown.adload, MacOffers, macOS:Adload-AM [Trj], MacOS:Adload-AX [Adw], MacOS:Adload-CV [Drp], MacOS:Agent-AHI [Trj], MacOS:Agent-MX [Trj], MacOS:Agent-PP [Adw], MacOS:Downloader-BS [Drp], MacOS\/Adload.A.gen!Camelot, MacOS\/Agent.A.gen!Camelot, MacOS\/Agent.B.gen!Camelot, Malware.OSX\/Adload.jleie, Malware.OSX\/Agent.ipwvv, Malware.OSX\/AVI.Adload.avslq, Malware.OSX\/AVI.Agent.gczrk, Malware.OSX\/AVI.Downloader.beswh, Malware.OSX\/Dldr.Adload.ergvp, Malware.OSX\/GM.Adload.OC, Malware.OSX\/GM.Agent.TR, Malware.OSX\/GM.Downloader.TM, MaxOfferDeal, Mughthesec (PUA), Not-a-virus:HEUR:AdWare.OSX.Agent.al, OSX.AdLoad!g1, Osx.Adware.Adload-9885354-2, Osx.AdWare.Agent.Hajl, Osx.Trojan-Downloader.Adload.Anhl, Osx.Trojan-Downloader.Agent.Hjgl, Osx.Trojan-Downloader.Lador.Wimw, Osx.Trojan.Adload.Fflw, Osx.Trojan.Agent.Qwhl, Osx.Trojan.Dldr.Bujl, Osx.Trojan.Gm.Rqil, OSX\/Adload.AX!tr.dldr, OSX\/Agent.BQ!tr, OSX\/Dldr.Adload.pgzct, OSX\/Dwnldr-AASO, OSX\/TrojanDownloader.Adload.AK, Password-Stealer ( 0040f4f11 ), Python:Downloader-AJ [Drp], RDN\/Generic.osx, Static AI &#8211; Malicious Mach-O, Static AI &#8211; Suspicious Mach-O, Trojan-Downloader.OSX.Adload, Trojan-Downloader.OSX.Agent.ad, Trojan:MacOS\/Lador.B!MTB, Trojan:MacOS\/Multiverze, Trojan.Adware.MAC.Adload.22, Trojan.Adware.MAC.Lador.1, Trojan.Application.MAC.Adload.8, Trojan.MAC.Adload.AM (B), Trojan.OSX.Adload.4!c, Trojan.OSX.Agent.4!c, Trojan.OSX.Lador.a!c, Trojan[downloader]:MacOS\/Adload.AH, TrojanDownloader:MacOS\/Adload.B!MTB, TrojanDownloader:MacOS\/SAgnt.C!MTB, TrojanDropper:MacOS\/Lador.K!MTB, Unix.Malware.Lador-9884300-0, Unix.Malware.Macos-9882334-0, Win32.Trojan-Downloader.Agent.Edhl<\/span><a name=\"learnmore\"><\/a><\/p>\n<h3>How can I learn more?<\/h3>\n<p>Be sure to also check out our <a href=\"https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/#forecast\">2025 Apple malware forecast<\/a> and our previous <a href=\"https:\/\/www.intego.com\/mac-security-blog\/category\/malware\/\">Mac malware articles<\/a> from 2025 and earlier.<\/p>\n<p><a href=\"https:\/\/podcast.intego.com\/\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" class=\"alignleft\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2021\/04\/intego-podcast-artwork-400.jpg\" alt=\"\" width=\"80\" \/><\/a>Each week on the <a href=\"https:\/\/podcast.intego.com\/\" target=\"_blank\" rel=\"noopener\"><strong>Intego Mac Podcast<\/strong><\/a>, Intego&#8217;s Mac security experts discuss the latest Apple news, including security and privacy stories, and offer practical advice on getting the most out of your Apple devices. Be sure to <a href=\"https:\/\/podcasts.apple.com\/us\/podcast\/intego-mac-podcast\/id1293834627\" rel=\"noopener\"><strong>follow the podcast<\/strong><\/a> to make sure you don\u2019t miss any episodes.<\/p>\n<p>You can also subscribe to our <a href=\"https:\/\/www.intego.com\/mac-security-blog\/mac-security-newsletter\/\"><strong>e-mail newsletter<\/strong><\/a> and keep an eye here on <a href=\"https:\/\/www.intego.com\/mac-security-blog\"><strong>The Mac Security Blog<\/strong><\/a> for the latest Apple security and privacy news. And don&#8217;t forget to follow Intego on your favorite social media channels: <a href=\"https:\/\/x.com\/IntegoSecurity\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" style=\"border-width: 1px; border-style: solid; border-color: rgba(255, 255, 255, 0.2); border-radius: 8px;\" title=\"Follow Intego on \ud835\udd4f\/Twitter\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/X-Twitter-logo-icon-225.gif\" alt=\"Follow Intego on X\/Twitter\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/www.facebook.com\/Intego\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" style=\"border-width: 1px; border-style: solid; border-color: rgba(255, 255, 255, 0.2); border-radius: 8px;\" title=\"Follow Intego on Facebook\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/Facebook-logo-icon-225.gif\" alt=\"Follow Intego on Facebook\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/www.youtube.com\/user\/IntegoVideo?sub_confirmation=1\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" style=\"border-width: 1px; border-style: solid; border-color: rgba(0, 0, 0, 0.2); border-radius: 8px;\" title=\"Follow Intego on YouTube\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/YouTube-logo-icon-225.png\" alt=\"Follow Intego on YouTube\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/www.pinterest.com\/intego\/\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" style=\"border-width: 1px; border-style: solid; border-color: rgba(0, 0, 0, 0.2); border-radius: 8px;\" title=\"Follow Intego on Pinterest\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/Pinterest-logo-icon-225.png\" alt=\"Follow Intego on Pinterest\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/www.linkedin.com\/company\/intego\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" style=\"border-width: 1px; border-style: solid; border-color: rgba(255, 255, 255, 0.2); border-radius: 8px;\" title=\"Follow Intego on LinkedIn\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/LinkedIn-logo-icon-225.gif\" alt=\"Follow Intego on LinkedIn\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/www.instagram.com\/intego_security\/\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" style=\"border-width: 1px; border-style: solid; border-color: rgba(255, 255, 255, 0.2); border-radius: 8px;\" title=\"Follow Intego on Instagram\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/Instagram-logo-icon-225.gif\" alt=\"Follow Intego on Instagram\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/podcasts.apple.com\/us\/podcast\/intego-mac-podcast\/id1293834627\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" style=\"border-width: 1px; border-style: solid; border-color: rgba(255, 255, 255, 0.2); border-radius: 8px;\" title=\"Follow the Intego Mac Podcast on Apple Podcasts\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2017\/10\/ios9-podcasts-app-tile.png\" alt=\"Follow the Intego Mac Podcast on Apple Podcasts\" width=\"16\" \/><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Intego\u2019s malware research team has taken a closer look at OSX\/Adload adware samples, and found that decompiled Python scripts seem to be undetected by most antivirus vendors.<\/p>\n","protected":false},"author":14,"featured_media":103113,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[190],"tags":[86,4625],"class_list":["post-103092","post","type-post","status-publish","format-standard","has-post-thumbnail","category-malware","tag-mac-malware","tag-osx-adload"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"Intego\u2019s malware research team has taken a closer look at OSX\/Adload adware samples, and found that decompiled Python scripts seem to be undetected by most antivirus vendors.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Joshua Long\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"The Mac Security Blog - Keep Macs safe from the dangers of the Internet\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Intego discovers undetected OSX\/Adload decompiled Python adware\" \/>\n\t\t<meta property=\"og:description\" content=\"Intego\u2019s malware research team has taken a closer look at OSX\/Adload adware samples, and found that decompiled Python scripts seem to be undetected by most antivirus vendors.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-02-13T20:26:53+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-02-14T06:34:34+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/integogroup\/\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@IntegoSecurity\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Intego discovers undetected OSX\/Adload decompiled Python adware\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Intego\u2019s malware research team has taken a closer look at OSX\/Adload adware samples, and found that decompiled Python scripts seem to be undetected by most antivirus vendors.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@IntegoSecurity\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/intego-discovers-undetected-osx-adload-decompiled-python-adware\\\/#blogposting\",\"name\":\"Intego discovers undetected OSX\\\/Adload decompiled Python adware\",\"headline\":\"Intego discovers undetected OSX\\\/Adload decompiled Python adware\",\"author\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/author\\\/joshlong\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/Mac-macOS-OSX-malware-on-iMac-ghostly-figure-with-python-400x260-1.jpg\",\"width\":400,\"height\":260,\"caption\":\"Mac macOS OSX malware on iMac with ghostly figure and python Adload\"},\"datePublished\":\"2025-02-13T12:26:53-08:00\",\"dateModified\":\"2025-02-13T22:34:34-08:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/intego-discovers-undetected-osx-adload-decompiled-python-adware\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/intego-discovers-undetected-osx-adload-decompiled-python-adware\\\/#webpage\"},\"articleSection\":\"Malware, Malware, OSX\\\/Adload, joshlong\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/intego-discovers-undetected-osx-adload-decompiled-python-adware\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/category\\\/malware\\\/#listItem\",\"name\":\"Malware\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/category\\\/malware\\\/#listItem\",\"position\":2,\"name\":\"Malware\",\"item\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/category\\\/malware\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/intego-discovers-undetected-osx-adload-decompiled-python-adware\\\/#listItem\",\"name\":\"Intego discovers undetected OSX\\\/Adload decompiled Python adware\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/intego-discovers-undetected-osx-adload-decompiled-python-adware\\\/#listItem\",\"position\":3,\"name\":\"Intego discovers undetected OSX\\\/Adload decompiled Python adware\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/category\\\/malware\\\/#listItem\",\"name\":\"Malware\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#organization\",\"name\":\"The Mac Security Blog\",\"description\":\"Keep Macs safe from the dangers of the Internet\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/logo2.png\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/intego-discovers-undetected-osx-adload-decompiled-python-adware\\\/#organizationLogo\",\"width\":122,\"height\":46},\"image\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/intego-discovers-undetected-osx-adload-decompiled-python-adware\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/integogroup\\\/\",\"https:\\\/\\\/x.com\\\/IntegoSecurity\",\"https:\\\/\\\/www.instagram.com\\\/intego_security\\\/\",\"https:\\\/\\\/www.youtube.com\\\/user\\\/IntegoVideo\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/intego\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/author\\\/joshlong\\\/#author\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/author\\\/joshlong\\\/\",\"name\":\"Joshua Long\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/intego-discovers-undetected-osx-adload-decompiled-python-adware\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/ed8c9b8cc8610160efb5aa95bc28a7a0d5a23ce9b8959054305b11094bf0485a?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"Joshua Long\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/intego-discovers-undetected-osx-adload-decompiled-python-adware\\\/#webpage\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/intego-discovers-undetected-osx-adload-decompiled-python-adware\\\/\",\"name\":\"Intego discovers undetected OSX\\\/Adload decompiled Python adware\",\"description\":\"Intego\\u2019s malware research team has taken a closer look at OSX\\\/Adload adware samples, and found that decompiled Python scripts seem to be undetected by most antivirus vendors.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/intego-discovers-undetected-osx-adload-decompiled-python-adware\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/author\\\/joshlong\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/author\\\/joshlong\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/Mac-macOS-OSX-malware-on-iMac-ghostly-figure-with-python-400x260-1.jpg\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/intego-discovers-undetected-osx-adload-decompiled-python-adware\\\/#mainImage\",\"width\":400,\"height\":260,\"caption\":\"Mac macOS OSX malware on iMac with ghostly figure and python Adload\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/intego-discovers-undetected-osx-adload-decompiled-python-adware\\\/#mainImage\"},\"datePublished\":\"2025-02-13T12:26:53-08:00\",\"dateModified\":\"2025-02-13T22:34:34-08:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#website\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/\",\"name\":\"The Mac Security Blog\",\"description\":\"Keep Macs safe from the dangers of the Internet\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>Intego discovers undetected OSX\/Adload decompiled Python adware<\/title>\n\n","aioseo_head_json":{"title":"Intego discovers undetected OSX\/Adload decompiled Python adware","description":"Intego\u2019s malware research team has taken a closer look at OSX\/Adload adware samples, and found that decompiled Python scripts seem to be undetected by most antivirus vendors.","canonical_url":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#blogposting","name":"Intego discovers undetected OSX\/Adload decompiled Python adware","headline":"Intego discovers undetected OSX\/Adload decompiled Python adware","author":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/author\/joshlong\/#author"},"publisher":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2025\/02\/Mac-macOS-OSX-malware-on-iMac-ghostly-figure-with-python-400x260-1.jpg","width":400,"height":260,"caption":"Mac macOS OSX malware on iMac with ghostly figure and python Adload"},"datePublished":"2025-02-13T12:26:53-08:00","dateModified":"2025-02-13T22:34:34-08:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#webpage"},"isPartOf":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#webpage"},"articleSection":"Malware, Malware, OSX\/Adload, joshlong"},{"@type":"BreadcrumbList","@id":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.intego.com\/mac-security-blog#listItem","position":1,"name":"Home","item":"https:\/\/www.intego.com\/mac-security-blog","nextItem":{"@type":"ListItem","@id":"https:\/\/www.intego.com\/mac-security-blog\/category\/malware\/#listItem","name":"Malware"}},{"@type":"ListItem","@id":"https:\/\/www.intego.com\/mac-security-blog\/category\/malware\/#listItem","position":2,"name":"Malware","item":"https:\/\/www.intego.com\/mac-security-blog\/category\/malware\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#listItem","name":"Intego discovers undetected OSX\/Adload decompiled Python adware"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.intego.com\/mac-security-blog#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#listItem","position":3,"name":"Intego discovers undetected OSX\/Adload decompiled Python adware","previousItem":{"@type":"ListItem","@id":"https:\/\/www.intego.com\/mac-security-blog\/category\/malware\/#listItem","name":"Malware"}}]},{"@type":"Organization","@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization","name":"The Mac Security Blog","description":"Keep Macs safe from the dangers of the Internet","url":"https:\/\/www.intego.com\/mac-security-blog\/","logo":{"@type":"ImageObject","url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2026\/08\/logo2.png","@id":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#organizationLogo","width":122,"height":46},"image":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#organizationLogo"},"sameAs":["https:\/\/www.facebook.com\/integogroup\/","https:\/\/x.com\/IntegoSecurity","https:\/\/www.instagram.com\/intego_security\/","https:\/\/www.youtube.com\/user\/IntegoVideo","https:\/\/www.linkedin.com\/company\/intego"]},{"@type":"Person","@id":"https:\/\/www.intego.com\/mac-security-blog\/author\/joshlong\/#author","url":"https:\/\/www.intego.com\/mac-security-blog\/author\/joshlong\/","name":"Joshua Long","image":{"@type":"ImageObject","@id":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/ed8c9b8cc8610160efb5aa95bc28a7a0d5a23ce9b8959054305b11094bf0485a?s=96&d=mm&r=g","width":96,"height":96,"caption":"Joshua Long"}},{"@type":"WebPage","@id":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#webpage","url":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/","name":"Intego discovers undetected OSX\/Adload decompiled Python adware","description":"Intego\u2019s malware research team has taken a closer look at OSX\/Adload adware samples, and found that decompiled Python scripts seem to be undetected by most antivirus vendors.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#website"},"breadcrumb":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#breadcrumblist"},"author":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/author\/joshlong\/#author"},"creator":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/author\/joshlong\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2025\/02\/Mac-macOS-OSX-malware-on-iMac-ghostly-figure-with-python-400x260-1.jpg","@id":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#mainImage","width":400,"height":260,"caption":"Mac macOS OSX malware on iMac with ghostly figure and python Adload"},"primaryImageOfPage":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/#mainImage"},"datePublished":"2025-02-13T12:26:53-08:00","dateModified":"2025-02-13T22:34:34-08:00"},{"@type":"WebSite","@id":"https:\/\/www.intego.com\/mac-security-blog\/#website","url":"https:\/\/www.intego.com\/mac-security-blog\/","name":"The Mac Security Blog","description":"Keep Macs safe from the dangers of the Internet","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization"}}]},"og:locale":"en_US","og:site_name":"The Mac Security Blog - Keep Macs safe from the dangers of the Internet","og:type":"article","og:title":"Intego discovers undetected OSX\/Adload decompiled Python adware","og:description":"Intego\u2019s malware research team has taken a closer look at OSX\/Adload adware samples, and found that decompiled Python scripts seem to be undetected by most antivirus vendors.","og:url":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/","article:published_time":"2025-02-13T20:26:53+00:00","article:modified_time":"2025-02-14T06:34:34+00:00","article:publisher":"https:\/\/www.facebook.com\/integogroup\/","twitter:card":"summary_large_image","twitter:site":"@IntegoSecurity","twitter:title":"Intego discovers undetected OSX\/Adload decompiled Python adware","twitter:description":"Intego\u2019s malware research team has taken a closer look at OSX\/Adload adware samples, and found that decompiled Python scripts seem to be undetected by most antivirus vendors.","twitter:creator":"@IntegoSecurity"},"aioseo_meta_data":[],"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/www.intego.com\/mac-security-blog\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/www.intego.com\/mac-security-blog\/category\/malware\/\" title=\"Malware\">Malware<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\tIntego discovers undetected OSX\/Adload decompiled Python adware\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.intego.com\/mac-security-blog"},{"label":"Malware","link":"https:\/\/www.intego.com\/mac-security-blog\/category\/malware\/"},{"label":"Intego discovers undetected OSX\/Adload decompiled Python adware","link":"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-undetected-osx-adload-decompiled-python-adware\/"}],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/103092","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/users\/14"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/comments?post=103092"}],"version-history":[{"count":12,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/103092\/revisions"}],"predecessor-version":[{"id":103118,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/103092\/revisions\/103118"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/media\/103113"}],"wp:attachment":[{"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/media?parent=103092"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/categories?post=103092"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/tags?post=103092"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}