As you install it, it automatically installs Advanced Mac Cleaner, which uses Siri’s voice to tell you it found a problem.īut behind the scenes, it locks Safari’s homepage to a Crossrider domain, and can’t easily be changed. Pretty typical for macOS and nothing we haven’t seen before. This strain of Crossrider comes in the form of a fake Adobe Flash Player installer. It’s Mac Flash malware and different than the original breed because it installs certain configuration profiles to stay persistent ( via Malwarebytes). A variant of the Crossrider adware has been spotted in the wild.
