How to eliminate the TodoSwift malware from your Mac
Written by Tomas Meskauskas on (updated)
What kind of malware is TodoSwift?
TodoSwift is a malicious program classed a dropper. Discovered in the summer of 2024, this malware is designed to deliver second-stage payloads while displaying a decoy document to victims.
TodoSwift exhibits similar behavior to malware developed and used by a North Korean state-backed threat actor, specifically the BlueNorOff unit of the Lazarus Group. Hence, it is likely that TodoSwift is a tool utilized by this threat actor.
TodoSwift malware overview
TodoSwift is designed to drop additional malware or malicious components onto infected devices. It hides its activities with a decoy document. This malware fetches a PDF file from the Google Drive file-hosting service.
The known variant downloads a document titled "Bitcoin Price Prediction Using Machine Learning" (file/filename may vary) and displays it to the victim. The PDF itself is not malignant; the actual malicious file is downloaded afterward from an attacker-controlled domain.
TodoSwift has two key tasks to carry out: making the file executable and executing it – thus, the dropper furthers the infection by introducing and launching the next-stage payload. It is currently unknown how the attack progresses past this point.
Theoretically, malicious software within the dropper and similar categories can cause just about any type of infection (e.g., trojan, ransomware, cryptominer, etc.). However, in practice, these programs operate within certain specifications and limitations. Furthermore, attacks carried out by sophisticated threat actors are usually targeted and have specific goals.
To summarize, the presence of malicious software like TodoSwift on devices can lead to system infections, severe privacy issues, financial losses, and identity theft. It must be mentioned that when malware is leveraged against high-sensitivity targets – it can pose threats of greater significance.
| Name | TodoSwift virus |
| Threat Type | Mac malware, Mac virus, dropper |
| Detection Names | Avast (MacOS:DangerousSig [Trj]), Combo Cleaner (Trojan.MAC.Lazarus.Z), ESET-NOD32 (OSX/NukeSped.AO), Kaspersky (HEUR:Trojan-Downloader.OSX.Lazarus.gen), Full List Of Detections (VirusTotal) |
| Symptoms | Malware is designed to stealthily infiltrate the victim's device and remain silent, and thus no particular symptoms are clearly visible on an infected machine. |
| Distribution Methods | Malicious email attachments, social engineering, software "cracks", malvertising. |
| Damage | Stolen passwords and banking information, identity theft, the victim's computer added to a botnet. |
| Malware Removal (Mac) | To eliminate possible malware infections, scan your Mac with legitimate antivirus software. Our security researchers recommend using Combo Cleaner. |
Mac-targeting malware examples
We have written about numerous malicious programs; Cthulhu, HZ RAT, fake Unarchiver, Banshee, and BeaverTail are just some of our latest articles on Mac-specific malware.
Malicious software can have a wide variety of functionalities or have a narrowly tailored purpose. Yet regardless of how malware operates – its presence on a system threatens device integrity and user safety. Therefore, all threats must be eliminated immediately upon detection.
How did TodoSwift install on my computer?
At the time of writing, the methods used to proliferate TodoSwift are unknown. Generally, malware is distributed by relying on phishing and social engineering tactics.
Malware is predominantly spread via drive-by (stealthy or deceptive) downloads, malicious attachments or links in spam mail (e.g., emails, PMs/DMs, SMSes, etc.), online scams, malvertising, untrustworthy download sources (e.g., freeware and third-party websites, Peer-to-Peer sharing networks, etc.), pirated content, illegal software activation tools ("cracks"), and fake updates.
Furthermore, some malicious programs can self-proliferate through local networks and removable storage devices (e.g., external hard drives, USB flash drives, etc.).
How to avoid installation of malware?
We strongly advise exercising caution when browsing since fraudulent and malicious online content usually appears legitimate and innocuous. Incoming emails and other messages must be approached with care. Attachments or links present in suspicious/irrelevant mail must not be opened, as they can be virulent.
Another recommendation is to download only from official and verified sources. All programs must be activated and updated using genuine functions/tools, as those obtained from third-parties can contain malware.
We must stress that having a dependable anti-virus installed and kept up-to-date is critical to device and user safety. Security software must be used to run regular system scans and to remove detected threats and issues. If your computer is already infected, we recommend running a scan with Combo Cleaner Antivirus for macOS to automatically eliminate the malware.
Instant automatic Mac malware removal:
Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of Mac malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner for Mac
By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.
Quick menu:
Potentially unwanted applications removal:
Remove potentially unwanted applications from your "Applications" folder:
Click the Finder icon. In the Finder window, select "Applications". In the applications folder, look for "MPlayerX","NicePlayer", or other suspicious applications and drag them to the Trash. After removing the potentially unwanted application(s) that cause online ads, scan your Mac for any remaining unwanted components.
Remove adware-related files and folders
Click the Finder icon, from the menu bar. Choose Go, and click Go to Folder...
Check for adware generated files in the /Library/LaunchAgents/ folder:
In the Go to Folder... bar, type: /Library/LaunchAgents/
In the "LaunchAgents" folder, look for any recently-added suspicious files and move them to the Trash. Examples of files generated by adware - "installmac.AppRemoval.plist", "myppes.download.plist", "mykotlerino.ltvbit.plist", "kuklorest.update.plist", etc. Adware commonly installs several files with the exact same string.
Check for adware generated files in the ~/Library/Application Support/ folder:
In the Go to Folder... bar, type: ~/Library/Application Support/
In the "Application Support" folder, look for any recently-added suspicious folders. For example, "MplayerX" or "NicePlayer", and move these folders to the Trash.
Check for adware generated files in the ~/Library/LaunchAgents/ folder:
In the Go to Folder... bar, type: ~/Library/LaunchAgents/
In the "LaunchAgents" folder, look for any recently-added suspicious files and move them to the Trash. Examples of files generated by adware - "installmac.AppRemoval.plist", "myppes.download.plist", "mykotlerino.ltvbit.plist", "kuklorest.update.plist", etc. Adware commonly installs several files with the exact same string.
Check for adware generated files in the /Library/LaunchDaemons/ folder:
In the "Go to Folder..." bar, type: /Library/LaunchDaemons/
In the "LaunchDaemons" folder, look for recently-added suspicious files. For example "com.aoudad.net-preferences.plist", "com.myppes.net-preferences.plist", "com.kuklorest.net-preferences.plist", "com.avickUpd.plist", etc., and move them to the Trash.
Scan your Mac with Combo Cleaner:
If you have followed all the steps correctly, your Mac should be clean of infections. To ensure your system is not infected, run a scan with Combo Cleaner Antivirus. Download it HERE. After downloading the file, double click combocleaner.dmg installer. In the opened window, drag and drop the Combo Cleaner icon on top of the Applications icon. Now open your launchpad and click on the Combo Cleaner icon. Wait until Combo Cleaner updates its virus definition database and click the "Start Combo Scan" button.
Combo Cleaner will scan your Mac for malware infections. If the antivirus scan displays "no threats found" - this means that you can continue with the removal guide; otherwise, it's recommended to remove any found infections before continuing.
After removing files and folders generated by the adware, continue to remove rogue extensions from your Internet browsers.
Remove malicious extensions from Internet browsers
Remove malicious Safari extensions:
Open the Safari browser, from the menu bar, select "Safari" and click "Preferences...".
In the preferences window, select "Extensions" and look for any recently-installed suspicious extensions. When located, click the "Uninstall" button next to it/them. Note that you can safely uninstall all extensions from your Safari browser - none are crucial for regular browser operation.
- If you continue to have problems with browser redirects and unwanted advertisements - Reset Safari.
Remove malicious extensions from Google Chrome:
Click the Chrome menu icon 
(at the top right corner of Google Chrome), select "More Tools" and click "Extensions". Locate all recently-installed suspicious extensions, select these entries and click "Remove".
- If you continue to have problems with browser redirects and unwanted advertisements - Reset Google Chrome.
Remove malicious extensions from Mozilla Firefox:
Click the Firefox menu 
(at the top right corner of the main window) and select "Add-ons and themes". Click "Extensions", in the opened window locate all recently-installed suspicious extensions, click on the three dots and then click "Remove".
- If you continue to have problems with browser redirects and unwanted advertisements - Reset Mozilla Firefox.
Frequently Asked Questions (FAQ)
My computer is infected with TodoSwift malware, should I format my storage device to get rid of it?
Malware removal rarely necessitates formatting.
What are the biggest issues that TodoSwift malware can cause?
The threats associated with an infection depend on the malware's capabilities and the cyber criminals' goals. TodoSwift is a dropper – a type of malware that drops additional malicious payloads. Generally, infections of this kind can cause system infections, serious privacy issues, financial losses, and identity theft.
What is the purpose of TodoSwift malware?
Malware is mainly used for profit. However, there are other motivations behind malware attacks. There is evidence linking TodoSwift to the Lazarus Group – a threat actor linked to the state of North Korea. Hence, TodoSwift infections may be driven by reasons other than revenue, such as cyber espionage or geopolitics.
How did TodoSwift malware infiltrate my computer?
Malware is primarily spread through drive-by downloads, dubious download sources (e.g., freeware and free file-hosting websites, P2P sharing networks, etc.), online scams, spam mail, malvertising, pirated content., illegal program activation tools ("cracks"), and fake updates. Some malicious programs can self-proliferate via local networks and removable storage devices.
Will Combo Cleaner protect me from malware?
Yes, Combo Cleaner can detect and eliminate most of the known malware infections. Remember that sophisticated malicious software usually hides deep within systems – therefore, performing a complete system scan is paramount.
Outstanding!
▼ Show Discussion