How to remove Activator malware from infected computers

Also Known As: Activator backdoor
Type: Mac Virus
Damage level: Severe

What is Activator?

Recently, cracked apps on pirating websites that carried a Trojan proxy were discovered. The bad actors took pre-cracked apps, repackaged them as PKG files, and hid a Trojan proxy along with a script to infect systems after installation. The application named Activator is also involved in the malicious campaign.

Activator malware

More about the campaign involving Activator

The identified samples demonstrated successful execution on macOS Ventura 13.6 and later, indicating a focus on users with newer operating system versions, encompassing both Intel processors and Apple silicon machines.

Within the compromised disk images, a program named Activator and the desired application are present. When users open or mount the image, a window appears with installation instructions. Users are instructed to copy the app to /Applications/ and then initiate Activator.

The Activator features a "PATCH" button. Clicking the "PATCH" button (and entering a password) triggers a chain of events designed for persistent and covert interaction with external servers. In this stage, a Python script is downloaded. This script reveals the malware operators' intentions of executing commands received from the server.

Simultaneously, the script gathers and sends system information, including the operating system version, directories in /Users/, a list of installed applications, CPU type, and the external IP address. Periodic updates can also occur, adjusting metadata like the C2 server details, program GUID, and version.

In the last stage, the script adds a cryptostealer that checks for cryptowallet applications like Exodus and Bitcoin-Qt. If found, it replaces them with infected versions from the specified server. The stolen wallets send data to a malicious server. Even without new commands, the program can still cause harm by stealing users' cryptowallets, compromising their security.

Threat Summary:
Name Activator backdoor
Threat Type Mac malware, Mac virus, Backdoor
Detection Names Arcabit (Trojan.MAC.Generic.D1C91A [many]), Combo Cleaner (Trojan.MAC.Generic.117018), G-Data (Trojan.MAC.Generic.117031), Kaspersky (UDS:DangerousObject.Multi.Generic), Full List Of Detections (VirusTotal)
Symptoms Trojans are designed to stealthily infiltrate the victim's computer and remain silent, and thus no particular symptoms are clearly visible on an infected machine.
Distribution Methods Shady websites, pirated/cracked software
Damage Monetary loss (stolen cryptocurrency)
Malware Removal (Mac)

To eliminate possible malware infections, scan your Mac with legitimate antivirus software. Our security researchers recommend using Combo Cleaner.
▼ Download Combo Cleaner for Mac
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.


In conclusion, the multi-stage malware campaign involves the deployment of various malicious components. Beginning with a downloader, it progresses through stages that include covert communication with a C2 server, execution of arbitrary commands, and the introduction of a cryptostealer targeting popular cryptowallet applications.

The campaign is dynamic, showcasing ongoing development with periodic updates to adapt to the changing environment. The intent appears to be financially motivated, exploiting unsuspecting users by compromising their cryptowallets.

How did malware install on my computer?

The malware distribution unfolds through deceptive means, with initial exposure occurring on pirated websites where cracked applications are shared. Malicious actors utilize these platforms to circulate infected software, initially disguising it as legitimate applications. Users unwittingly download and install these compromised applications, initiating the malware's infiltration process.

Also, users can infect their computers through phishing emails, where clicking on malicious links or opening infected attachments launches malware. Additionally, drive-by downloads from compromised websites pose a risk, automatically installing malware when users visit such sites.

In other cases, users cause computer infections through malicious ads, downloads from P2P networks, third-party downloaders, shady app stores, etc. Using outdated software can also result in having a computer infected.

How to avoid installation of malicious applications?

Regularly update their operating systems, software, and security applications to patch vulnerabilities and defend against the latest threats. Implement reputable antivirus and anti-malware software. Avoid clicking on suspicious links or opening attachments within suspicious emails, and refrain from visiting untrustworthy websites or clicking ads on them.

Download apps from official pages or app stores and avoid obtaining pirated software or cracking tools. If your computer is already infected, we recommend running a scan with Combo Cleaner Antivirus for macOS to automatically eliminate all threats.

The installer containing Activator:

Activator malware installer

Instant automatic Mac malware removal: Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of Mac malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner for Mac By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Quick menu:

Unwanted applications removal:

Remove potentially unwanted applications from your "Applications" folder:

Manual removal of malicious Mac applications

Click the Finder icon. In the Finder window, select "Applications". In the applications folder, look for "Activator" and other suspicious applications, and drag them to the Trash. After removing unwanted application(s), scan your Mac for any remaining unwanted components.

Frequently Asked Questions (FAQ)

My computer is infected with Activator malware, should I format my storage device to get rid of it?

Before resorting to formatting your storage device, it's advisable to try using antivirus software like Combo Cleaner. Antivirus tools can often effectively detect and remove malware, providing a less drastic solution while preserving your data.

What are the biggest issues that malware can cause?

Malware can cause significant issues, including compromised system security, data breaches, loss of sensitive information, financial theft, unauthorized access, system instability, data encryption, etc.

What is the purpose of Activator malware?

Activator malware is crafted with the intent of undergoing a sequence of stages, enabling persistent and discreet engagement with external servers. A crypto stealer is introduced during the final stage, which scans for and substitutes existing crypto wallet applications with compromised versions. Subsequently, the pilfered wallet data is sent to a malicious server.

How did Activator malware infiltrate my computer?

Activator malware is distributed using pages hosting pirated applications. It is likely that you unknowingly downloaded and installed such an application and initiated the malware's infiltration process.

Will Combo Cleaner protect me from malware?

Combo Cleaner is effective in detecting and eradicating the majority of known malware infections. It is important to recognize that high-end malware often hides deeply within the system. As a result, running a full system scan is required for successful detection and removal.

▼ Show Discussion

About the author:

Tomas Meskauskas

Tomas Meskauskas - expert security researcher, professional malware analyst.

I am passionate about computer security and technology. I have an experience of over 10 years working in various companies related to computer technical issue solving and Internet security. I have been working as an author and editor for pcrisk.com since 2010. Follow me on Twitter and LinkedIn to stay informed about the latest online security threats. Contact Tomas Meskauskas.

PCrisk security portal is brought by a company RCS LT. Joined forces of security researchers help educate computer users about the latest online security threats. More information about the company RCS LT.

Our malware removal guides are free. However, if you want to support us you can send us a donation.

About PCrisk

PCrisk is a cyber security portal, informing Internet users about the latest digital threats. Our content is provided by security experts and professional malware researchers. Read more about us.

Removal Instructions in other languages
Malware activity

Global malware activity level today:

Medium threat activity

Increased attack rate of infections detected within the last 24 hours.

QR Code
Activator backdoor QR code
Scan this QR code to have an easy access removal guide of Activator backdoor on your mobile device.
We Recommend:

Get rid of Mac malware infections today:

Download Combo Cleaner for Mac

Platform: macOS

Editors' Rating for Combo Cleaner:
Editors ratingOutstanding!

[Back to Top]

To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.