A New Mac Malware Has Been Detected

We’ve detected a new Mac malware that is able to bypass Apple’s built-in security protections. The malware is being spread via malicious Google web searches. If you were to click on one of these sites, and it redirects you to a page to download and execute Adobe Flash, it is most likely a malicious threat.

The malware is called ‘Schlayer’ and according to Intego, “The Shlayer malware is delivered as a Trojan horse application on a .dmg disk image, masquerading as an Adobe Flash Player installer. After the deceptive Flash Player installer is downloaded and opened on a victim’s Mac, the disk image will mount and display instructions on how to install it. The instructions tell users to first “right-click” on flash Installer and select Open, and then to click Open in a dialog box.

If a user follows the instructions, the “installer app” launches. While the installer has a Flash Player icon and looks like a normal Mac app, it’s actually a bash shell script that will briefly open and run itself in the Terminal app.

As the script runs, it extracts a self-embedded, password-protected .zip archive file, which contains a traditional (though malicious) Mac .app bundle. After installing the Mac app into a hidden temporary folder, it launches the Mac app and quits the Terminal. All this takes place within a split second.

Once the Mac app launches, it downloads a legitimate, Adobe-signed Flash Player installer, so that it can appear to be genuine—but the hidden Mac app is designed to also have the capability to download any other Mac malware or adware package, at the discretion of those controlling the servers to which the hidden Mac app phones home.

The developers’ decision to hide the Mac .app within a password-protected .zip file, and to hide that within a bash shell script, is a novel idea—and it is also extremely clear evidence that the developers are trying to evade detection by antivirus software.”

Read more about Shlayer here.

Remember to always be careful on what you click on. To verify a website, hover your mouse over the link and the correct URL will be displayed in the bottom left hand corner of your browser. Also, always double check that the website has https:/ in the URL. The ‘S’ stands for secure. HTTPS helps protects the integrity of the website by preventing hackers from tampering with and listening to the communications between the website and your browser. It also protects your privacy and security.
If you ever have any questions regarding malware or the legitimacy of a website, email, or attachment, you can email us at Support@AugustaITGuys.com.

The Augusta IT Guys

4332 Wheeler Road #105, Augusta GA 30907


Follow your Augusta IT Guys on FacebookTwitterInstagram, and Linkedin