5

The following modal dialog prompting for a software update password has been popping up a few times and I really do not know what to make of it:

  1. it seems to be controlled by the Finder (not a browser or any particular app)
  2. it does not seem to be part of the standard macOS update workflow, but coincidentally, there is an update available (as seen in my System Preferences)
  3. I cannot find a single hit on Google for the exact wording in that modal
  4. It seems plausible that it could come from one of the (very few) system extensions I have installed, but no indication of which.

Any idea how I could confirm whether this is legit (although horrible UX) or Malware. And if the latter: how could I go about finding the source (the fact that this pops-up would indicate that the system is already partly compromised).

enter image description here

Improve this question
9
  • Download the free version of Malwarebytes and give your Mac a scan. It is usually pretty good at finding nasty and/or sketchy stuff. I run it weekly. In fact, since it is early morning on Monday where I am on the planet, I'm going to run it now!
    – IconDaemon
    Commented Feb 27, 2023 at 12:22
  • I did run Malwarebyte, and it did not find anything. But the above modal is so mindbogglingly stupid UX if it is a legit Apple modal, that I am forced to consider a worst case scenario.
    – Dave
    Commented Feb 27, 2023 at 12:28
  • 1
    Cancel that dialog and see whether you genuinely have an update waiting. 'Apple' | System Settings | General | Software Update. If there is, update it from there (a trusted interaction) and then see if that popup stops appearing after. If not, then it's from another source.
    – Andy Griffiths
    Commented Feb 27, 2023 at 12:31
  • I've never seen that particular modal, but there similar low-fi modals that pop up from time to time.
    – IconDaemon
    Commented Feb 27, 2023 at 12:32
  • 1
    Sorry I missed that you'd seen a pending update in your OP. Great minds think alike ;-)
    – Andy Griffiths
    Commented Feb 27, 2023 at 12:37

1 Answer 1

Reset to default
2

This appears the same as when you run an update. However, to confirm I would recommend doing the following:

Cancel out of the alert and go to System Settings. Press to install the update. You will receive an alert shortly after that looks like this and can enter your password to install the update.

You can also download & run Malwarebytes to be safe - it doesn't hurt.

Improve this answer
1
  • More or less came to the conclusion (noticed that the modal popping up when manually triggering the update from System Settings was near-identical). Would have loved to hear the rationale for such a stupid UX, but in any case, I am at least reassured that I am not infected somehow.
    – Dave
    Commented Feb 28, 2023 at 13:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .