Never mind that Flash has been effectively deprecated for years and that platforms offering warez and pirated content are a known breeding ground for malware. Once users click, they receive a notice that they should install a Flash update.

It’s seeded in links that promise pirated versions of commercial software, episodes of TV shows, or live feeds of sports matches. Shlayer also uses curl with the combination of options -f0L, which Thursday’s post said “is basically the calling card of the entire family.”Īnother banal detail about Shlayer is its previously mentioned infected method. The download is then deleted to remove traces of an infection. Under the hood, the workflow for all versions is similar: they collect IDs and system versions and, based on that information, download and execute a file. For malware using such a crude and outdated infection method, Shlayer remains surprisingly prolific.Īn analysis Kaspersky Lab published on Thursday says that Shlayer is “a rather ordinary piece of malware” that, except for a recent variant based on a Python script, was built on Bash commands. Germany, with 14 percent, and France and the UK (both with 10 percent) followed. Attacks are most common against US users, who account for 31 percent of attacks Kaspersky Lab sees. The malware accounts for 30 percent of all malicious detections generated by the Kaspersky Lab’s Mac AV products. Since Shlayer first came to light in February 2018, Kaspersky Lab researchers have collected almost 32,000 different variants and identified 143 separate domains operators have used to control infected machines.

The lure may be trite and easy to spot, but Shlayer continues to be common-so much so that it’s the number one threat encountered by users of Kaspersky Labs’ antivirus programs for macOS. It usually does so after promising pirated videos, which are also fake. Almost two years have passed since the appearance of Shlayer, a piece of Mac malware that gets installed by tricking targets into installing fake Adobe Flash updates.

Adobe update for mac virus