How to remove Mughthesec

Mughthesec – Mac virus that might remain undetected due to its effective evasion techniques

Mughthesec is a type of malware that usually attaches itself to Safari, Google Chrome, or another browser as an extension, although it also drops files on the system. Designed strictly for Macs, this malicious program gains access to the device behind users' backs, namely, fake Flash Player installers that could be encountered on malicious websites around the internet. These might be titled Player.dmg, while, during the installation, users might only see an Installer.app shown to them.

Once installed, the Mughthesec virus drops multiple malicious .plist files and establishes persistence by evading security software. It also installs several malicious apps designed for Macs, including the notorious scarware^[1] Advanced Mac Cleaner. It also hijacks users' web browsers, sets the homepage to a.akamaihd.net, and delivers intrusive advertisements and sponsored links on a regular basis. Hence, its main goal is to gain revenue from ads and remain undetected on the infected machine for as long as possible.

Fake Flash Player updates have been used to spread malware around for ages now, and Mac users are pretty much accustomed to this type of online scams. Upon accessing a malicious website, visitors are presented with a fake version of the plugin, with the claim that it is needed in order to display website contents or play multimedia.

Unfortunately, to this day, users are still getting deceived by this old trick and end up installing potentially unwanted programs or malware on their systems. There could be many apps that would be disguised as the Mughthesec virus, thus making it virtually impossible to detect if the user is unaware that it is installed in the first place. For example, UniversalWebResults or AnySearch were found to be one of the main culprits of the infection.

Once installed, malware would deliver a pop-up, asking users to install the following applications:

• Advanced Mac Cleaner
• Safe Finder
• Booking.com.

These apps are very typical adware designed to use scam techniques to make users buy stuff online. Do not allow these to be installed on your system, as you will only infect your device further! After that, users will see their browsers completely messed up, as their homepage settings would be altered, and results redirected to Yahoo.

What is particularly interesting about this malware is its ability to avoid detection by most security software due to its effective evasion technique. Once launched, it deploys a binary that includes the names of the most common security applications used on Mac devices. However, updated versions of security software should be able to detect and stop the infiltration of the virus.

Due to malware's nature, one of the main ways to detect it on a Mac is by using a powerful Firewall. It can blog the insecure connection when the installed tries to establish it to download its malicious files onto a computer.

Another interesting feature of Mughthesec malware is that it tries to avoid analysis completely when it detects that a virtual machine is used. According to researchers:^[2]

<…>it turns out that the installer actually doesn't do anything malicious, (besides actually installing a legit copy of Flash), if it detects it running in VM.

Nonetheless, it is important to clean the system properly when trying to remove Mughthesec virus from your system fully, and you might have to employ several tools for that, combining it with the manual instructions we provide below. FortectIntego can also be used as a tool to clean the leftovers of the virus if such need arises.

Fake Flash Player installers are prevalent on Macs – learn to avoid them

Flash Player has been terminated fully by Adobe in January 2021 and is no longer supported.^[3] From a security standpoint, it is definitely good riddance, as this plugin has been possibly the most exploited tool by cybercriminals. There are two ways threat actors employ it for malicious deeds:

• Use fake installers to trick users into installing PUPs or malware;
• Exploit numerous software vulnerabilities found within the plugin.

Therefore, without exceptions, you should simply not use Flash – even the legitimate version. There is simply no need for it, as it has long been replaced with new technologies such as HTML 5. All the claims that it needs to be updated in order to view some online content are fake and a scam, so you should never listen to these requests.

While some fake installers may be signed with a valid certificate (making the infiltration of malware a much easier process, as signed files bypass the built-in Gatekeeper protection), most are not, so security software should be able to detect malicious versions of such files easily.

Manual Mughthesec removal might not be a straightforward process

In order to remove Mughthesec virus from your device, you need to eliminate all of its components, along with those that were brought in during the infection of the system. It includes the following files and folders:

~/Library/Application Support/com.Mughthesec/Mughthesec
~/Library/LaunchAgents/com.Mughthesec.plist

You also need to use launchctl to unload the payload that is running in the background with the following command:

 launchctl unload ~/Library/LaunchAgents/com.Mughthesec.plist

Finally, you need to uninstall Any Search extension, along with all other unrecognized components on your browsers. To find out how to do that, you should check the instructions below.

However, if you are a novice computer user, we highly recommend performing automatic Mughthesec removal with an updated anti-malware software. You will not have to worry about malicious .plist files, and other components dropped by malware, as security applications are capable of automatically finding and deleting them.