VindInstaller Malware Brings PUPs and Adware to Macs

The VindInstaller Malware runs on Mac systems exclusively, and it was first spotted near the end of 2020. The malware uses a very peculiar method to reach its victims – its creators are setting up fake websites, which are then artificially boosted to show up on the first pages of search engines when the user looks for specific content. The payload of the VindInstaller is typically deployed with the use of a fake Adobe Flash Player installer, which executes additional scripts to silently drop malicious files in the background.

But what does this malware do? It is meant to generate revenue for its operators by abusing pay-per-install (PPI) offers to deploy Potentially Unwanted Programs (PUPs) or adware on the compromised computer. The malware may spawn misleading messages and prompts to trick users into installing shady software or visiting low-quality websites hosting fraudulent content. Some researchers mention that there are many similarities between the shell scripts that VindInstaller uses compared to popular Mac malware families like Shlayer and Bundlore. The Shlayer Trojan was also often used in combination with PUPs such as the AMCleaner.

Typically, the VindInstaller infection will remain unnoticed by users – the best way to prevent this threat from coming onto your Mac is to use a reputable antivirus software suite. Failing to stop VindInstaller will not have malicious consequences, but it may worsen your Mac's performance and behavior by introducing intrusive adware, Potentially Unwanted Programs, and other dubious software.