ShlayerMalware
According to PCrisk, Shlayer is a trojan-type virus designed to proliferate various adware and other unwanted applications, and promote fake search engines. It is typically disguised as a Adobe Flash Player installer and various software cracking tools.From MISP Galaxy
Last reported 18 months ago, by Huntress6 reports
ATT&CK techniques
6 of 7 · each with the sentence it comes from- T1036Masquerading
“Still, this development helps crack down on macOS malware that tries to bypass TCC through bombarding users with TCC prompts or masquerading as legitimate software.”
- T1543.001Launch Agent
“…ng Launch Daemons, which are property list files (plist) on various locations on the disk that are executed at the system level, and Launch Agents, which require a user session and execute specific binaries from plists.”
- T1543.003Windows Service
“That means that instead of using Windows services or the registry for persistence, macOS malware will instead use different processes.”
- T1543.004Launch Daemon
“These have most typically been Launch Items in macOS, including Launch Daemons, which are property list files (plist) on various locations on the disk that are executed at the system level, and Launch Agents, which require a user session and execute specific binaries from plists.”
- T1553.002Code Signing
“An additional security mechanism that is utilized by this process is code signing.”
- T1564.014Extended Attributes
“If we run xattr <path_to_application> from our command line, it will list out the extended attributes.”
What the reports say
6 reports, newest first · the exact sentence from each-
Say Hello to Mac Malware“Threat actors behind macOS malware like the Shlayer adware dropper have used this weakness in their attacks.”
-
Debunking 5 Major macOS Myths“…es much more in the way of nation-state activity, macOS observes items like PUPs, adware like search engine hijacking and clickbait, or Shlayer, which leverages social engineering techniques to get the user to override Gatekeeper to execute.”
-
Ask the Mac Guy: macOS Security Myths“We've witnessed malware exploiting 0-days in the operating system to persist, as well as leveraging shells like zsh along with the Shlayer malware.”
-
Endpoint Security In a macOS World“If we look at the sample below, we can see the Shlayer malware running some commands from the command line.”
-
Built-in macOS Security Tools“Malware like Shlayer uses this ability to skirt around Apple's security mechanisms and social engineers users into opening their apps.”
-
macOS Support Is Here!“…may not be familiar with macOS in general—for example, by choosing to masquerade as common Windows programs like Adobe Flash Player, as Shlayer did within the last year.”
Indicators in its reports
named in the reports above- mrt[.]appin 1 report
Copy this indicator · defanged
Thanks — we review every report.