Researcher finds one of the first examples of malware written to run natively on Apple's M1 chips; the GoSearch22 adware installs itself as a Safari extension
A security researcher found one of the first examples of malware written to run natively on Apple's M1 processors. — Lorenzo Franceschi-Bicchierai
Context & Ripple Effects
GoSearch22 is the opening data point in a short, fast-moving arc: days after this finding, researchers surfaced Silver Sparrow, M1-native malware on at least 30K Macs that leveraged the Installer JavaScript API, and Apple responded by revoking the developer certificates behind it. The M1 transition gave malware authors a fresh compile target, and both samples showed up within weeks of the chip shipping.
The deeper backdrop is that macOS's trust chain has been leaking for a while — an earlier campaign ran adware notarized by Apple itself, and OSX/Linker showed a binary could bypass Gatekeeper entirely. GoSearch22's Safari-extension delivery adds a browser layer to that list, which is why the M1-native angle matters: it signals attackers are keeping pace with Apple's silicon shift, not just its software.
First-order effects
- M1 Mac owners are the immediate exposure: adware now ships compiled for Apple silicon, so the architecture advantage of a fresh platform is gone from day one, and a Safari extension is the infection vector users actually see.
- Apple's review pipeline is directly implicated again — following the notarized-adware episode, GoSearch22 shows malicious code slipping through the same signing and notarization gates meant to stop it.
Second-order effects
- Apple's enforcement lever is certificate revocation, the same move it made against Silver Sparrow's developer accounts — expect that to become the standing playbook, pushing malware authors toward fresh developer identities and short-lived campaigns.
- Security researchers and endpoint vendors now have to maintain M1-native detection alongside Intel builds, splitting their tooling during the transition period and widening the window for samples that only exist in ARM form.
Third-order effects
- If every Apple silicon generation becomes a compile target within weeks of launch, Mac security shifts structurally toward runtime and distribution controls — notarization, extension review, certificate policing — rather than signature-based scanning, and Apple's role as gatekeeper of its own ecosystem gets harder to distinguish from the attack surface itself.
The trend: As Apple moves the Mac onto its own silicon, malware is being ported to each new architecture almost immediately, making the notarization-and-certificate pipeline the real battleground for macOS security.