{"id":84208,"date":"2018-11-14T11:32:03","date_gmt":"2018-11-14T19:32:03","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=84208"},"modified":"2026-08-08T05:11:44","modified_gmt":"2026-08-08T12:11:44","slug":"ad-injecting-mac-malware-rediscovered","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/ad-injecting-mac-malware-rediscovered\/","title":{"rendered":"Ad-injecting Mac malware rediscovered: SearchPageInjector\/SearchAwesome"},"content":{"rendered":"

Most people assume that there’s little, if any, Mac malware out there in the wild. Unfortunately, that notion is merely wishful thinking.<\/p>\n

Malware analysts\u2014even those focused on Mac malware\u2014process so many malware samples that not every new piece of malware necessarily gets its own dedicated article or press release.<\/p>\n

Such was the case with OSX\/SearchPageInjector<\/strong>, Mac malware that Intego has been detecting since January 2018. OSX\/SearchPageInjector recently came back on our radar after Thomas Reed wrote up a piece<\/a> about it under the name OSX.SearchAwesome.<\/p>\n

Since it has been in the news recently, let’s take a look at what this malware does and how to avoid it.<\/p>\n

What Is OSX\/SearchPageInjector?<\/h3>\n

OSX\/SearchPageInjector<\/strong> is Mac malware designed to inject remotely hosted JavaScript code into every Web page the victim visits.<\/p>\n

The JavaScript code has been observed to inject advertisements, but it could also potentially be used for cryptojacking\u2014i.e. hijacking the Mac’s processing power to mine cryptocurrency on behalf of the attacker; see our audio podcast<\/a> and our\u00a0YouTube video<\/a> on cryptojacking\u2014or more sinister purposes such as stealing usernames and passwords.<\/p>\n

OSX\/SearchPageInjector makes use of open-source man-in-the-middle proxy software to inject the attacker’s JavaScript code into all Web sites\u2014even those delivered over HTTPS, the more secure HTTP alternative that’s used by most popular Web sites.<\/p>\n

How Do Macs Get Infected With OSX\/SearchPageInjector?<\/h3>\n

This malware comes as a second-stage infection after a user downloads a supposedly “cracked” version of an app from a torrent.<\/p>\n

\"\"Apps downloaded from torrents<\/a>\u00a0often contain malware.<\/p>\n

Thus, to avoid this particular infection, users simply need to avoid the temptation to download illegal copies of software.<\/p>\n

How Can I Clean an Infected Mac?<\/h3>\n

Intego VirusBarrier<\/a> has been detecting and eradicating OSX\/SearchPageInjector since January 2018.<\/p>\n

If the malware has been removed from your computer and you know you don’t use the open-source\u00a0software\u00a0mitmproxy<\/a>, then you’ll also want to open the Keychain Access app (found in the \/Applications\/Utilities folder) and search for and delete the root certificate authority named mitmproxy.<\/p>\n

\"\"If you didn’t install mitmproxy, delete its root CA in Keychain Access. Screenshot: Reed<\/a><\/p>\n

Where Can I Learn More?<\/h3>\n

We briefly discussed OSX\/SearchPageInjector on the November 2 edition<\/a> of the Intego Mac Podcast; be sure to subscribe<\/a> to make sure you don’t miss future episodes!<\/p>\n

For\u00a0additional technical details about OSX\/SearchPageInjector, you can\u00a0refer to\u00a0Reed’s write-up<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

Most people assume that there’s little, if any, Mac malware out there in the wild. Unfortunately, that notion is merely wishful thinking. Malware analysts\u2014even those focused on Mac malware\u2014process so many malware samples that not every new piece of malware necessarily gets its own dedicated article or press release. Such was the case with OSX\/SearchPageInjector, […]<\/p>\n","protected":false},"author":14,"featured_media":84232,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[190],"tags":[86,4399],"class_list":["post-84208","post","type-post","status-publish","format-standard","has-post-thumbnail","category-malware","tag-mac-malware","tag-osxsearchpageinjector"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t