{"id":77743,"date":"2018-04-24T11:45:09","date_gmt":"2018-04-24T18:45:09","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=77743"},"modified":"2018-04-24T11:45:09","modified_gmt":"2018-04-24T18:45:09","slug":"new-osxshlayer-malware-variant-found-using-a-dirty-new-trick","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/new-osxshlayer-malware-variant-found-using-a-dirty-new-trick\/","title":{"rendered":"New OSX\/Shlayer Malware Variant Found Using a Dirty New Trick"},"content":{"rendered":"

\"OSX\/Shlayer<\/p>\n

Last\u00a0February, Intego researchers discovered<\/a> a new variant of the OSX\/Shlayer malware,\u00a0disguising itself as an Adobe Flash Player update to infect systems with adware. OSX\/Shlayer was also found in torrent downloads as part of (or pretending to be) software cracks.<\/p>\n

Today, Thomas Reed reported<\/a> on a new variant\u00a0of OSX\/Shlayer that uses new tricks to get its job done. It installs a configuration profile that forces a browser’s homepage to be set as “chumsearch[dot]com.” This profile would take control of the homepage settings in Safari and Chrome and also set the “Open new window with” or “Open new tab with” settings to use the Chumsearch URL. While we did not observe this behavior in our tests, we did find a few other interesting things.<\/p>\n

How are Macs getting infected?<\/h3>\n

As with the previously discovered Shlayer malware variants, this one comes as either a fake Adobe Flash Player\u00a0or\u00a0a crack (patch) to some kind of paid software. To pick up one of these fake Adobe Flash Player installers, one must wander around BitTorrent sites<\/a> and it’ll surely pop up.<\/p>\n

To obtain Shlayer as part of a software crack,\u00a0BitTorrent\u00a0sites are also to blame. This is not to say that this malware variant, or any other variants, can’t be found on other possibly legit websites, but we\u00a0have yet to spot Shlayer there.<\/p>\n

Once a user is tricked into downloading the fake Adobe Flash Player (or a site downloads it automatically), the result is typically a self mounting disk image. The user is then presented with a window that looks mostly like this:<\/p>\n

\"\"<\/p>\n

Once the installer is launched, an agreement will pop up that looks absolutely nothing like the one included in the real Adobe Flash Player installer, and two installation types are offered: Express (recommended) or Custom Installation (expert). The wording is, of course, carefully chosen to deter users from selecting the Custom Installation option and seeing what is really being installed.<\/p>\n

\"\"<\/p>\n

Even without scrolling through it, you can tell the presented agreement does not reference Adobe Flash Player, instead it references Advanced Mac Cleaner. This should be a big red flag, but most users may be\u00a0so accustomed to quickly\u00a0clicking “OK,” “Continue” and “Agree” to finally get their installation going.\u00a0(These windows could mention irrefutable proof Bigfoot exists and in all likelihood no-one would notice.)<\/p>\n

\"\"<\/p>\n

When the “Accept >>” button is clicked, the user will be presented with a password request.<\/p>\n

\"\"<\/p>\n

And when the “Ok” button is clicked, the installer will take over. A window will cover most of the screen and display a progress bar asking the user to please wait. This window cannot be activated, moved or closed.<\/p>\n

\"\"<\/p>\n

What does OSX\/Shlayer install?<\/h3>\n

With the installer window open, several components are downloaded in the background. This includes all or some of the following:<\/p>\n