Shlayer Trojan Accounted for 30 Percent of Detections for macOS in 2019

guest · Jan 23, 2020

Shlayer Trojan Accounted for 30 Percent of Detections for macOS in 2019
January 23, 2020
https://www.tripwire.com/state-of-s...unted-for-30-of-detections-for-macos-in-2019/

The Shlayer trojan accounted for approximately 30 percent of all of Kaspersky Lab’s malware detections for the macOS platform in 2019.

Shlayer first fell into the hands of Kaspersky back in February 2018. Since that time, its solutions have collected nearly 32,000 different samples of the trojan. They’ve also pinpointed 143 distinct command-and-control (C&C) server domains.
Overall, Shlayer featured in 30% of Kaspersky’s detections for its macOS users over the course of 2019.

Kaspersky found Shlayer to be “a rather ordinary piece of malware” with primarily Bash-based variants. Even so, its researchers did uncover Trojan-Downloader.OSX.Shlayer.e, a Python-based variant that used a slightly different operation algorithm than its cousins.
Click to expand...

Kaspersky: Shlayer Trojan attacks one in ten macOS users

guest · Jan 25, 2020

The Sneaky Simple Malware That Hits Millions of Macs
How the Shlayer Trojan topped the macOS malware charts—despite its “rather ordinary” methods
January 25, 2020
https://www.wired.com/story/macos-shlayer-trojan-adware/

The popular misconception that Macs don’t get viruses has become a lot less popular in recent year [...] But it’s still surprising that the most prolific malware on macOS—by one count, affecting one in 10 devices—is so relatively crude.

Shlayer’s brilliance, it turns out, lies less in its code than its method of distribution. The operators behind the trojan reportedly offer website owners, YouTubers, and Wikipedia editors a cut if they push visitors toward a malicious download.
A complicit domain might prompt a phony Flash download, while a shortened or masked link in a YouTube video’s description or Wikipedia footnote might initiate the same.

“Apple does a great job making their OS more and more secure with every new release,” says Kuskov. “But it is hard to prevent such attacks on the OS level, since it's the user who clicks on a link and downloads Shlayer and runs it, like any other software.”
Click to expand...

While Flash might seem like an outdated lure, given the numerous public warnings about its fallibility and the fact that it’s dying off completely this year anyway, it’s actually perversely effective.

“I think the reason why fake Flash Players are so successful, in spite of these facts, is twofold,” says Joshua Long, chief security analyst at Intego, which first discovered Shlayer nearly two years ago. “Force of habit, and lack of awareness of the current state of Flash.”
Click to expand...

guest · Jun 17, 2020

Shlayer Mac Malware Returns with Extra Sneakiness
Spreading via poisoned Google search results
June 17, 2020
https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/

A fresh variant of the Shlayer Mac OSX malware with advanced stealth capabilities has been spotted in the wild, actively using poisoned Google search results in order to find its victims.

According to researchers at Intego, the malware, like many malware samples before it, is purporting to be an Adobe Flash Player installer. However, it has its own unique characteristics: It takes a crafty road to infection once it’s downloaded, all in the name of evading detection.
To start with, the masquerading “installer” is downloaded as a .DMG disk image, according to Intego’s analysis.

“After the deceptive Flash Player installer is downloaded and opened on a victim’s Mac, the disk image will mount and display instructions on how to install it,” explained Joshua Long, chief security analyst at Intego, in a posting on Monday.
Click to expand...

“The developers’ decision to hide the Mac .APP within a password-protected .ZIP file, and to hide that within a bash shell script, is a novel idea—and it is also extremely clear evidence that the developers are trying to evade detection by antivirus software,” Long noted.
Click to expand...

Intego: New Mac malware reveals Google searches can be unsafe

Intego has discovered new Mac malware in the wild, actively spreading through malicious results in Google searches.
Click to expand...

guest · Sep 11, 2020

ZShlayer: New macOS malware variant obfuscates scripts to slip past security tools
Stealthy malware can go unnoticed by antivirus scanners
September 11, 2020
https://portswigger.net/daily-swig/...bfuscates-scripts-to-slip-past-security-tools

Researchers have discovered a new Shlayer macOS malware variant which obfuscates itself to sneak past security tools and compromise a target machine.

Dubbed ‘ZShlayer’, the variant does not conform to the original Shlayer signatures, meaning that it can go unnoticed by some malware scanners.
Notably, ZShlayer heavily obfuscates Zsh scripts to disguise itself.

A blog post from Phil Stokes, threat researcher at SentinelOne, who discovered the strain, reads: “Although bypassing Apple’s Notarization checks is obviously a headline grabber, this new variant of Shlayer utilizes heavily obfuscated Zsh scripts and is in fact far more prolific in the wild.”
Click to expand...

Fortunately, it seems that ZShlayer infections are currently isolated to users who have downloaded illicit software outside of Apple’s official App Store ecosystem.
He added: “Most ZShlayer droppers that I saw are in trojanized cracked software, so the usual caveat applies about avoiding downloading pirated versions of products.”
Click to expand...

SentinelOne: Coming Out of Your Shell: From Shlayer to ZShlayer

Earlier this year, we discussed how threat actors have been turning to scripting languages as a preferred means of both dropping malware and executing payloads.

A recent variant of the Shlayer malware follows Apple’s lead in preferring Zsh to Bash as its default shell language and employs a novel encoding method to avoid detection. In this post, we describe this variant and show how it can be decoded to reveal the telltale Shlayer signature.
Click to expand...

Inside the New ZShlayer Variant
Whereas earlier versions of Shlayer like Shlayer.a came as shell script executables on a removable .DMG disk image, the new ZShlayer malware goes back to using a standard Apple application bundle inside the .DMG.
How Prevalent is ZShlayer in the Wild?
Searching for ZShlayer on VirusTotal reveals a large number of individual samples and shows that this variant has been active since late June 2020. As of today, our latest retrohunt showed 172 samples. Some of the parent DMGs of these samples have a reputation score of 0/58 on VT.
Click to expand...

Rasheed187 · Sep 12, 2020

mood said: ↑

ZShlayer: New macOS malware variant obfuscates scripts to slip past security tools
Stealthy malware can go unnoticed by antivirus scanners
September 11, 2020
https://portswigger.net/daily-swig/...bfuscates-scripts-to-slip-past-security-tools

SentinelOne: Coming Out of Your Shell: From Shlayer to ZShlayer
Click to expand...

It would be nice to know which AV's would fail to detect this new variant.

Minimalist · Apr 26, 2021

Apple fixes macOS zero-day bug exploited by Shlayer malware

Apple has fixed a zero-day vulnerability in macOS exploited in the wild by Shlayer malware to bypass Apple's File Quarantine, Gatekeeper, and Notarization security checks and download second-stage malicious payloads.
Click to expand...

https://www.bleepingcomputer.com/ne...os-zero-day-bug-exploited-by-shlayer-malware/

guest · Jul 20, 2021

Flash May Be Dead, but ‘Shlayer’ Campaigns Are Still Using It as a Disguise
July 20, 2021
https://www.technadu.com/flash-may-be-dead-shlayer-campaigns-still-using-it-disguise/290573/

Distributors of the ‘Shlayer’ malware are still tricking macOS users with fake Flash Player update notifications.

The installation is finalized manually by the victim and takes place while hidden in the background.

Shlayer has been a constant pain for macOS users ever since its first appearance three years ago.

Click to expand...

Adobe announced the end of support for the Flash Player on December 31, 2020, all major browsers uprooted it even earlier, and users should be already aware of the fact that Flash isn’t a thing anymore. However, malware actors are still abusing the name. This tells us the old method still works well enough, not creating an incentive to change to a different theme. As reported by Crowdstrike, distributors of the ‘Shlayer’ malware for the macOS are still masquerading their software as a Flash update.

‘Shlayer’ has been around since 2018, and it is currently the most common type of malware targeting macOS systems. Ever since its humble beginnings, Shlayer used fake Flash updates to trick its victims into installing it on the Safari browser.
Multiple actors are using Shlayer for their own malicious purposes, while the malware authors are constantly maintaining and evolving the tool to use new bypasses and new zero-days. Each time a new trick was added, Crowdstrike recorded spikes in the infection numbers, and every time Apple released a fixing patch for the macOS, the numbers went down significantly.
Click to expand...

The main takeaway here is that if you’re ever met with a request to update your Flash Player, it’s malware attempting to nest in your computer. Flash is gone, and there’s no service or video platform requiring it anymore.
Click to expand...

Log in or Sign up

Shlayer Trojan Accounted for 30 Percent of Detections for macOS in 2019

guest Guest

guest Guest

guest Guest

guest Guest

Rasheed187 Registered Member

Minimalist Registered Member

guest Guest

Log in or Sign up

Shlayer Trojan Accounted for 30 Percent of Detections for macOS in 2019

guest Guest

guest Guest

guest Guest

guest Guest

Rasheed187 Registered Member

Minimalist Registered Member

guest Guest

Useful Searches