There are three versions of the malware, that were detected by Intego VirusBarrier as OSX/Shlayer.A, OSX/Shlayer.B, and OSX/Shlayer.C Shell Scripts are a way to run a series of commands on your computer.You can consider them as the mac version of a Windows.bat file.This enables the malware to run the script in background processes.Īccording to the Intego research team, the malware has acted like a dropper and dropping and installing OSX/MACOFFERS (also known as BundleMeUp, Mugthesec, and Adload) and a second payload called OSX/BUNDLORE.
#What do i do if my mac is infected with the shlayer trojan install#
These files are droppers and they will run different shell scripts to install different malwares onto your computer. Well after you click the ad it will install one of the following adware files:, , and.
You might be thinking why would these attackers want to promote these malicious links publicly on their own account, and the reason is that the unknown creator of this trojan setup a whole distribution system which offers pay for putting malicious links on their creations. Or even if you don’t use BitTorrent sites it might infect you via malicious links spread by attackers. Some popups are customized to your browser! Let me give you one example of this trojan: Let’s say you are on a torrent website (BitTorrent Sharing Websites are popular for sharing adware) it might display a popup like one of the samples in the image below: You’d think such widespread malware would be stopped by antivirus software, but no, this virus depends on the user to fall into their trap.
In 2019, Kaspersky Labs marked Shlayer as taking a 29.28% share of total attacked users on macOS. Despite that, cybercriminals are finding ways to avoid getting stopped.
Generally, macOS is considered one of the most secure operating systems globally because of its notarization process.
0 kommentar(er)
