ProgressionLegion Mac virus (Free Guide)

What is ProgressionLegion Mac virus?

ProgressionLegion is a malicious Mac application designed by cybercriminals

ProgressionLegion is a malicious application that establishes persistence once installed

ProgressionLegion is an unwanted and dangerous software for Macs that specializes in inserting malicious ads into users' browsers and tracking their personal data. It belongs to a widespread malware strain known as Adload, which has been around since at least late 2017 and has hundreds of versions released. The infection can usually be identified easily by the icon it uses – a magnifying glass on gray background.

Alarming traits of the ProgressionLegion virus can be traced to its distribution, as it uses fake Flash Player updates and pirated software installers for distribution – a typical trait of malware. Upon infiltration, it installs several persistence components and implements a new browser extension that it uses to steal user data through. The extension also changes the homepage of Safari, Chrome, or another used browser.

If you have spotted that your system is infected with ProgressionLegion adware, you should immediately take action to eliminate it. In this article, we provide all the necessary details for this process to be successful.

How did you get infected?

The best way to deal with malware is not to get infected in the first place, as once the deed happens, the consequences might be relatively serious – additional malware installation, personal data disclosure to malicious parties, financial losses, and similar issues become a possibility.

Adload is among the most prominent adware strains that target Macs. While it has been around for several years now, its simple yet effective distribution techniques contribute to its success greatly. The most common two methods for distribution used by ProgressionLegion developers are illegal software bundles and fake/misleading ads.

Flash is an almost iconic software that was dominating plugin for multimedia content online. Cybercriminals soon discovered that many of its vulnerabilities^[1] can be used to push malware to thousands of users automatically. While many of the flaws were patched, new ones arose.

Adobe finally decided to kill Flash at the end of 2020,^[2] as more advanced technologies were long developed by that time. This signifies that all prompts to update Flash past the end-of-life date is fake, and you are likely to be infected with malware if you download one of these installers.

When it comes to illegal software installers, you should simply never risk downloading them. There will always be a chance of being infected when visiting peer-to-peer networks that host illegal software; the so-called cracks would most certainly be flagged by security tools, regardless if they actually infect your device with malware or not.

Thus, it becomes impossible for regular computer users to check whether such tools are dangerous or not, and disabling anti-virus protection can result in immediate infection.

ProgressionLegion spreads via Flash Player installers and other misleading ads

ProgressionLegion capabilities and removal

Adload family members work in a rather simple principle – they use effective distribution methods and once users enter their Apple ID during the installation process of this malicious software, they automatically allow the virus to get installed with elevated permissions. Consequently, the malware establishes various malicious files and changes settings, which might make it difficult to remove.

There are two components of the ProgressionLegion – the main application installed on the system level and the extension installed on the browser. Both of these components perform important virus functions and need to be eradicated carefully.

As soon as users provide access to the app, it uses the built-in AppleScript to create Login Items and new Profiles. It also adds itself to the exception list within the Gatekeeper and XProtect,^[3] which allows it to remain on the system without being removed by the said defenses.

This is why, the easiest way to eliminate the infection is by scanning it with alternative security software, such as SpyHunter 5Combo Cleaner or Malwarebytes. Third-party security solutions could also help you to prevent the installation of Mac malware in the future, so we highly recommend keeping them running at all times.

If you would like to eliminate the infection manually, we provide the instructions below. Note that, regardless if you deleted malware with security software, we still recommend cleaning web browsers from cookies and other items to prevent unwanted tracking.

1. Remove the main app

We should start by stopping all the active processes that could be spawned by malware – you can do so by accessing Activity Monitor. Only then you should try deleting the main app:

• Open Applications folder
• Select Utilities
• Double-click Activity Monitor
• Here, look for suspicious processes and use the Force Quit command to shut them down
• From the menu bar, select Go > Applications
• In the Applications folder, look for all related entries
• Click on the app and drag it to Trash (or right-click and pick Move to Trash).

If you still couldn't eliminate the main app, you can try removing Login Items and unwanted User Profiles:

• Go to Preferences and select Accounts
• Click Login items and delete everything suspicious
• Next, pick System Preferences > Users & Groups
• Find Profiles and remove unwanted profiles from the list.
• Go to Preferences > Accounts > Login items and remove the malicious entries.

Finally, you have to get rid of the leftover files. Plist files especially are important to eliminate correctly, as they can help reinstate the virus afterward.

• Select Go > Go to Folder.
• Enter /Library/Application Support and click Go or press Enter.
• In the Application Support folder, look for any dubious entries and then delete them.
• Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and delete all the related .plist files.

2. Take care of your browser

If you opt for manual removal, you should first remove the browser extension from Safari (you will find instructions for other browsers at the bottom of this article):

• Click Safari > Preferences…
• In the new window, pick Extensions.
• Select the unwanted extension and select Uninstall.

Next, make sure you delete browser cookies and other components to prevent data trackers from continuing their job. You can easily perform this task automatically with FortectIntego, a maintenance utility that can clean your system from all the leftover files.

• Click Safari > Clear History…
• From the drop-down menu under Clear, pick all history.
• Confirm with Clear History.

If you are unable to delete the extension in a regular way, you can reset the browser to ensure it is uninstalled properly. Perform the following steps:

• Click Safari > Preferences…
• Go to the Advanced tab.
• Tick the Show Develop menu in the menu bar.
• From the menu bar, click Develop, and then select Empty Caches.