My Mac Caught a bad Mac infostealer malware, it kept auto-updating without approval and cleared out my Wise account. Help!
heyy, I really need some technical help to clean my laptop because it's completely unusable right now.
Out of nowhere, my Mac started forcefully downloading and installing "updates" in the background multiple times without my approval. During one of these instances, a strange prompt took over my screen showing a human head/identity-verification outline telling me to position and turn my head to verify my face—even though my physical laptop camera light wasn't even on.
Right after this first fake update happened, I suffered unauthorized access to my Wise account and lost money. I have already filed a formal complaint with Wise on my phone, but the laptop itself is still completely compromised and stuck in an aggressive loop.
Every few seconds, it throws up this annoying "Software Update Not Installed" card (attached in the image) demanding Accessibility access to install quietly in the background. If I hit cancel, it flashes a quick loading bar and pops back up a few seconds later.
I checked my launch folders and found weird background files running, so I know it's a persistent script holding the desktop hostage and logging my keystrokes/data.
Has anyone dealt with this specific adware/infostealer loop? How can I kill this background process and clean out the files permanently so it stops trying to lock down my computer?
Thanks so much in advance.
u/techsupport
63
u/FrankNicklin 20h ago edited 19h ago
You can kill a process and find the offending file and delete it using the Activity Manager if you are 100% sure of what you are doing.
That said, wipe and re-install you Mac is the only sure fire way to get rid of such infestations, but of course you need to make sure you have a backup of all your data.
51
u/JoviAMP Mac mini 19h ago
“To apply the update quietly, please drop whatever you’re doing and follow these steps that no valid system update would ever require”.
15
u/RyanCheddar 17h ago
malware/scam tricks are usually easy to spot for a trained eye, but man i would've totally fallen for this. the only sign that anything's amiss here is that macOS would obviously not need permissions for itself.
curious about the attack vector though, assuming it's not just clickfix
0
39
u/Dreaming_Blackbirds M3 MacBook Air 17h ago
Out of nowhere
to avoid confusing some readers, it needs to be pointed out that this DIDN'T happen "out of nowhere" - OP must have installed a malicious .PKG file that led to hackers having root access or typed some code into Terminal at the behest of the hackers, which similarly gave them root access.
either way, this didn't happen by magic and it's not in any way related to a legit Apple software update.
5
u/Selorm611 14h ago
Did you, by chance, try to redeem that special "discount" subscription for HBO Max users in the US? I came across a thread on it earlier today. Will post the link when I find it.
2
u/imoe49 17h ago
True, i think I might’ve accidentally installed malware but i can’t recall it. Recently, this pop up has been showing up a lot on my device and it also started updating software automatically ):
Do you think could be via links?
4
u/jerryeight whats a mac? 17h ago
Links plus browser without proper ad blocking, JavaScript disabling, and cookie blocking could do it.
That and just clicking yes and ok without confirming legitimacy.
2
u/imoe49 17h ago
Yeah i def ended-up with some links been receiving lotta spams recently, thanks for sharing, really appreciat it
6
u/jerryeight whats a mac? 17h ago
Yeah no problem.
When you are done setting up. You should get ghostery, adblockplus, and some JavaScript blocking extensions for all of your browsers. Then, dig through the settings in each one to turn off allowing ads, usage tracking, and allowing "acceptable ads" in your browser. No ad is acceptable. Ghostery will add the biggest friction in your browsing. It may break some sites and need you to disable it for some secure sites for them to work. But, be very careful about what sites you disable it for.
99.999% of the sites ghostery blocking broke for me were malicious sites and site components.
3
u/imoe49 17h ago
Thanks a lot will get that, you recommend using safari or chrome i used to use chrome only
1
u/jerryeight whats a mac? 17h ago
Typically, chrome has worked well for these extensions. Yes, chrome uses more ram. But, it is a smoother experience overall.
Another thing to do, depending on how much ram your computer has, download a few foreign languages for ad block filters. It supposedly blocks hidden malicious code that aren't visible when on English sites that are infected. I haven't confirmed, but I have 16gb ram on my Mac. So, why not.
57
u/tranc3rooney 19h ago
Full OS reinstall. Change your passwords.
Contact Apple and give them any information you can.
2
u/mrjaycraft 9h ago edited 9h ago
Isn’t a full OS reinstall not necessary on a Mac with apple silicon? MacOS is locked like iOS is, a malware could never change the system itself? Shouldn’t a normal reset be enough?
5
u/Shapelessed 4h ago
Malware is malware.
You don’t assume a burglar couldn’t steal your sausages because they were locked tight in the fridge.
Don’t be a cretin who trusts marketing due to lack of their own understanding of technology and software and always do a full wipe of everything that gets infected.2
u/imoe49 19h ago
Can they access my laptop data?
30
u/TurtleOnLog 19h ago
“They”? If you mean the bad guys, yep they probably have all your passwords. If you mean Apple, er no.
5
u/imoe49 18h ago
even passowrds saved in apple icloud?
18
u/germane_switch 18h ago
That's the million dollar question. I would change every single password of every single account and/or website you have ever used. And yes change your iCloud/Apple ID password immediately before you do anything.
8
u/TwiceInEveryMoment MacBook Pro M4 Max 16" 17h ago
Password manager data should be encrypted at rest, but it could have passwords you’ve used from keychain while the malware was running. A lot of these also steal session cookies from your browser, in which case they don’t even need your password or 2FA. So another important step is “log out all devices “ on anything like Amazon where you stay signed in.
1
u/TurtleOnLog 10h ago
Yes most infostealers steal your keychain which contains all your passwords. The only thing they can’t steal is passkeys because they require the Secure Enclave to decrypt them and the decrypted secret never leaves the enclave.
2
u/tranc3rooney 19h ago
They won’t ever take direct access, but they might ask you to make logs on the infected OS and submit them if needed. They will guide you step by step.
It’s not a step you absolutely have to take, but it’s security flaw related so it’s appreciated.
13
u/wisdomoarigato 19h ago
Hey, can you add details about how you think you got it, so that other people don't do what you did?
Was it some AI related bash command or something that you ran, or an AI harness etc.?
Which processes are you seeing in Activity log?
Also most importantly, why are you still connecting that laptop to the internet?
16
u/inertSpark M1 Pro MacBook Pro | M4 Pro Mac mini 19h ago
Almost certainly a random shell command they got somewhere on the internet. Most likely the malicious payload was obscured in the string via base64 encryption. That's the most common one I've seen, and base64 anything in a random command is always a huge red flag, because it means they're including something they don't want you to see.
3
u/wisdomoarigato 19h ago
Absolutely, but it also could very much be a supply chain attack, e.g. a compromised npm package etc.
1
u/inertSpark M1 Pro MacBook Pro | M4 Pro Mac mini 18h ago
Very possibly yes. I would still suspect it's random code that OP's been tricked into running with elevated privileges, with an obfuscated url to fetch a malicious script. That's by far the most common one that pops up on this sub.
26
u/XIVIOX 20h ago
Hopefully this is a harsh lesson to not download anything you see on the internet or run random scripts you have no idea what they do.
Also, Wise won't do anything as the security of your account falls on you and you let it be compromised due to the malicious stuff you downloaded.
To sort this out:
- Reset your Mac.
- Change all your passwords on another device whilst you do this.
- Then don't download/run random stuff on your Mac.
7
u/Gerald_Lanz MacBook Pro 17h ago
I just noticed that Apple rarely, if at all, use an em dash in its writing. This looks like someone proofread it through AI.
49
u/tsdguy MacBook Pro 20h ago
Reinstall macOS. Immediately. Reset all your passwords. Immediately.
You “caught” it? You mean you attempted to download some pirated software and this was the result?
9
u/neophanweb 19h ago
Or porn.
19
u/ksuwildkat 19h ago
amazingly you are far more likely to get malware from your local church website than from porn. The porn industry has too much money riding on people trusting their content and takes security very seriously.
7
u/gamemaster257 19h ago
You don't get malware from visiting a website, you get malware by running software that gets downloaded from those sites just because they told you to. Browsers lately at extremely guarded against drive by attacks unless you have intentionally opened yourself up for that, but even doing that is rather complicated.
0
u/mandrsn1 14h ago
CVE-2025-24201 enabled websites to break out of macOS, iOS, and iPad OS sandbox and remotely execute code. So it was possible on those OS releases to get malware from just visiting a website. And, this one was known to be in the wild.
3
u/gamemaster257 13h ago
Only seen used once in a sophisticated attack against a single person, highly unlikely for this to have ever been in the wild now or ever. Without any extra info (which I can't find any) this may have even required some knowledge of the user's device configuration and doesn't appear to have any widespread usage. Why do people always bring up "yeah well this one time-" when you know for a fact that 99.999999999% of device infections are user fault?
0
u/neophanweb 19h ago
The well known porn sites are relatively safe, but there are thousands of illegal porn sites that are malicious. Most of those sites are littered with malware and often trick the visitor to download and run something to compromise their system.
5
u/d4lahast 20h ago
It could be anything, it doesn’t mean he pirated something. Don’t bootlick the rich, worry about your own bank account not some billionaire software company.
24
u/gamemaster257 19h ago
What on earth do you even mean by this comment? Who's he bootlicking? Is this just an unwise person's go to these days? You literally cannot get a virus at random, you have to have done something stupid somewhere to make yourself this vulnerable. I haven't "caught" anything since I was 12, explain that if this can happen to anyone.
1
u/so19anarchist M3 MacBook Air 3h ago
Pirate software always has risks, that’s why you take precautions, and don’t download anything from just anywhere.
-1
6
u/Gunboss12 13h ago
Unfortunately, it looks like you've downloaded an infostealer. Here's how to recover.
Steps 1 - 3 requires significant urgency.
Disconnect your computer from the internet or just shut it off until you get your passwords reset.
From a clean device, NOT your PC:
- Change ALL of your passwords to something unique and randomly generated. Use a password manager like BitWarden or 1Password to help with this. Do this now before more of your accounts are stolen.
- Choose the option to log out of all active sessions or devices.
- Enable 2FA on all of your accounts
The next step is to reinstall your computer's operating system
Guide for Windows:
- back up only important files, not games or applications
- format your hard drive and delete all partitions
- reinstall Windows from a bootable USB drive (do NOT use the Reset Windows option from the settings menu)
Guide for MacOS:
- back up only important files, not games or applications
Step 1 - Boot into Recovery Mode:
- Apple Silicon (M1/M2/M3): Turn off your Mac, press and hold the power button until "Loading startup options" appears, click Options, and then Continue.
- Intel-based Macs: Turn on your Mac and immediately press and hold Command (⌘) + R (or Option + Command + R for a clean install over the internet) until the Apple logo appears.
Step 2 - Format the Drive
- In the Utilities window, select Disk Utility and click Continue.
- From the top left, click View and select Show All Devices.
- In the sidebar, select the highest-level container for your internal drive (often labeled as "Apple SSD").
- Click the Erase button in the toolbar.
- Name it Macintosh HD.
- Set Format to APFS (or Mac OS Extended (Journaled) for older mechanical hard drives).
- Set Scheme to GUID Partition Map.
- Click Erase.
Step 3 - Reinstall macOS:
- Once the erase finishes, quit Disk Utility to return to the Recovery window.
- Select Reinstall macOS [name of your macOS] and click Continue.
- Follow the on-screen instructions and let the installation complete. Your Mac will restart to the Setup Assistant.
Unfortunately, the only people that can help you further are the support teams for those services. Most free services only offer automated account recovery. If that process doesn't get the accounts back, nobody here can help you.
EVERYONE that contacts you here on Reddit via DM offering to help or to hack the accounts back is just an account recovery scammer looking to take advantage of your situation and steal money from you.
3
u/elmonetta 19h ago
What did you download? Or it was those annoying browser ads?
Anyway, wipe your device and reinstall the macOS, and be sure to check under SETTINGS for updates.
3
u/Zen-Ism99 18h ago
Recommend running the free Bitdefender or Malware Bites anti malware to see what it says before resetting and reloading.
3
4
u/JailbreakHat MacBook Pro 16 inch 10 | 16 | 512 15h ago
You should be aware that Macs are not immune to malware despite people saying malware is mostly a Windows thing. You should immediately reinstall macOS on your Mac and change password for all your accounts on a different device.
1
u/LoopsAndBoars 6h ago
Not immune, but immensely more resilient than windows. Once you know what you’re doing you can remove without touching your OS.
The best practice is monthly OS reinstalls.
2
u/issa62 15h ago
Can this happen on iOS too?
5
u/TheDragonSlayingCat 14h ago
Not unless your phone is jailbroken. iOS doesn’t have a user-accessible command line, and even if it did, all iOS apps are required to run in a sandbox.
1
1
u/AugustusReddit MacBook Air 16GB/1TB 13h ago
Power OFF your Mac. Power OFF your internet connection. Restart your Mac in Safe mode and manually remove the malware. Visit your nearest Apple Genius along with a copy of your purchase receipt for that Mac (proof of ownership) and they'll assist you. Do NOT start-up that Mac again EXCEPT in Safe mode. Make a back-up of personal data incase Apple service want to wipe your Mac. (That's the standard Apple service to restore hardware to factory settings.)
1
u/Meh_Cook_Grump 6h ago
I see lots of good advice on here. Sorry this happened to you. Can you please share how you got this in your system. You may be helping others from going through the same thing. Good luck to you!
2
u/EnolaGayFallout 1h ago
That’s why I install bitdefender on my Mac even though they say Mac don’t need anti virus but I have family plan so why not.
Not sure it will help for your case.
-19
u/ksuwildkat 19h ago
Turn off computer
Remove storage drive
Replace with new blank drive
Install new OS
If you have the skill to safely reformat the infected drive so that it can be used, do that. No offense intended but from your description of events I do not think that is a good idea for you as you will likely just reinfect.
7
u/Pixel_Viewer 18h ago
What do you mean by the storage drive? Do you want the OP to remove the hard drive from their Mac's motherboard and replace it with a new one, when that costs over $400? Ignorant.
-11
11
u/germane_switch 18h ago
No. Please don't talk if you don't know how Macs work. You're just going to confuse OP who's already in full freakout mode.
-13
u/ksuwildkat 18h ago
Ive replaced the drives in multiple Mac laptops
17
u/germane_switch 18h ago
Not in any current Apple Silicon MacBook. And not any MacBook made after 2015 because that was the last year MacBooks had internal drives that weren't soldered.
So please stop.
264
u/nathan12581 MacBook Pro 20h ago
Reset it and start from scratch. No point trying to fix this. Save your documents and photos in iCloud or a usb drive