Cybercriminals have been turning to scripting languages as a preferred means for both dropping malware and executing payloads. The most talked-about macOS malware, Shlayer, has hit the news again recently after being caught abusing Apple’s macOS notarization service.
A headline grabbing threat
In September, SentinelOne researcher Phil Stokes discovered a new variant of Shlayer macOS malware called ZShlayer that obfuscates itself to slip past security tools and compromise a target machine.
- Following Apple’s lead in preferring Zsh to Bash as its default shell language, the new variant employs heavily obfuscated Zsh scripts to avoid detection.
- Active since late-June, this new ZShlayer variant uses a standard Apple application bundle inside the .dmg file.
- Hence, it was able to slip past Apple’s notarizing checks and bombarded users of infected machines with unwanted ads.
Recent Shlayer-slinging campaigns
First found in 2018, Shlayer (aka OSX.Shlayer) malware has been packaged with malicious adware, which has continued to circulate until recent times.
- In July, over 1,000 malicious domains were used to distribute the Shlayer trojan, which installed adware on infected devices.
- In June, masquerading as an Adobe Flash Player installer, Mac malware Shlayer was delivered as a trojan horse via a DMG disk image file.
Worth noting
Abusing Apple’s Notarization service is clear proof that the Shlayer-ZShlayer campaigns are evolving to become more dangerous. Hackers are developing multiple threat campaigns against macOS users. Experts say organizations should use behavioral analysis to detect such sophisticated malware threats.
Publisher
/https://cyware-ent.s3.amazonaws.com/image_bank/shutterstock_328101638.jpg)
/https://cyware-ent.s3.amazonaws.com/image_bank/shutterstock_523236433.jpg)
