ReaderUpdate

ReaderUpdate is a macOS Trojan loader/loader malware family. Reporting describes it as a loader used to serve the Genieo (also known as DOLITTLE) adware, and notes that it is typically used to download intrusive adware, though it could deliver other Trojan payloads. Research published in 2025 said the malware had been largely dormant since 2023, but new samples showed expanded implementation diversity intended to evade detection. ReaderUpdate has been observed in multiple language variants, including Python, Crystal, Rust, Nim, and a newly identified Go-based variant. High-confidence reporting characterizes it as a macOS malware loader with evolving capabilities centered on payload delivery and detection evasion through diverse codebases. No specific threat actor, industry targeting, or concrete IOCs are provided in the supplied content.