Beginning on October 22, Mac users around the world began seeing troubling alerts related to printer software from HP (formerly known as Hewlett-Packard). A dialog box began appearing on some Macs that warned:
“[HP app name]” will damage your computer.
This file was downloaded on an unknown date.
Report malware to Apple to protect other users
(Show in Finder) (OK)
Around the same time, users of certain Amazon apps also began seeing a very similar dialog box:
“Amazon Music” will damage your computer. You should move it to the Trash.
This file was downloaded on an unknown date.
Report malware to Apple to protect other users
(Move to Trash) (Cancel)
Even a week later, we’re still seeing reports of similar dialog boxes appearing on macOS.
@HPSupport I’ve spent hours trying to get a live person to help me. My Mac is a constant steam of “HP app ___” will damage your computer. The HP Smart App does nothing to resolve this. PLEASE help.
— Stud Sterling (@StudSterling) October 29, 2020
So what exactly is going on? Are HP printer drivers and Amazon Music really infected with malware?
Apple has the ability to retroactively deauthorize Mac software that has been code-signed by a particular developer. This action is virtually always used to stop outbreaks of code-signed malware (hence the scary-sounding “Report malware to Apple” portion of the aforementioned dialog boxes). Very recently, Apple used this technique to stop actual code-signed malware, namely OSX/MacOffers Trojan horses that Apple had erroneously notarized.
But there are other potential reasons to revoke a code-signing certificate, too.
According to The Register, an HP Inc. spokesperson told the news site on October 23:
“We unintentionally revoked credentials on some older versions of Mac drivers. This caused a temporary disruption for those customers and we are working with Apple to restore the drivers. In the meantime, we recommend users experiencing this problem to uninstall the HP driver and use the native AirPrint driver to print to their printer.”
It remains unclear why exactly HP would have asked Apple to revoke its older certificates. This could potentially mean that HP’s code-signing certs may have fallen into the wrong hands, and may perhaps have been used by a malicious party. This is only speculation, however.
We reached out to HP for further comment but have not yet received an explanation from the company.
The Amazon Music app, and reportedly the Amazon WorkSpaces client application, also seem to have received the same treatment from Apple. At this time there is no known reason why macOS is blocking these Amazon apps.
Amazon has not yet replied to our inquiry.
An Apple spokeperson replied, “We don’t have any comment to share about this issue.”
If you’ve recently seen a dialog box like the ones above, specifically mentioning HP or Amazon software, that doesn’t necessarily mean that your Mac has been infected with malware.
Some users have reported that restarting their computer enabled them to use their HP or Amazon software again, so it’s worth trying that first.
If you’re experiencing problems with HP software, try opening System Preferences and clicking on Software Update to see if Apple offers you updated HP software. If not, you can also check HP’s customer support site for newer software for your specific printer. You can also try opening System Preferences, clicking on Printers & Scanners, deleting your HP printer, and then adding it again from scratch. There is also an HP Knowledge Base article with additional tips. HP Customer Support is also where you can request assistance if nothing else seems to work, and Twitter users can alternatively send @HPSupport a direct message.
If you’re having trouble with Amazon software, you can try re-downloading and re-installing Amazon Music or Amazon WorkSpaces. If that doesn’t resolve the problem, you can try to get help via Amazon’s support site or via Twitter direct message: @AmazonHelp.
You can also follow Intego on your favorite social and media channels: Facebook, Instagram, Twitter, and YouTube (click the 
