VORANT. Threat Intelligence Sign in Get the full feed

OSX.Shlayer Malware Gains Apple Notarization

routine threat

A fake Homebrew site (homebrew.sh) served OSX.Shlayer/Bundlore adware installers that Apple mistakenly notarized, letting them run as trusted software even on macOS Big Sur.

Researcher Patrick Wardle documents the first known case of malware bypassing Apple's code-notarization requirement, a security control introduced in macOS Catalina meant to ensure all distributed software is scanned by Apple before execution. A malicious site, homebrew.sh — a typosquat of the legitimate brew.sh — served fake Adobe Flash Player updates that led to installers ultimately identified as OSX.Shlayer, a highly prevalent macOS trojan that installs the Bundlore adware family. Unlike prior Shlayer campaigns which used unnotarized payloads blocked outright by macOS, these samples carried valid Apple notarization stamps, allowing them to execute without the usual warning/block dialog and lending them false legitimacy in the eyes of victims.

Analysis of the payloads showed a self-decrypting shell routine using openssl AES-256-CBC to extract and execute a hidden binary appended to an image file, consistent with known Shlayer techniques, alongside chmod and cleanup steps. Once notified, Apple revoked the abused Developer ID certificates on Aug 28, 2020, but the campaign persisted, re-signing and re-notarizing near-identical payloads under new developer identities within roughly 48 hours, demonstrating attacker agility in continuing to evade Apple's vetting pipeline.

The incident undercuts Apple's marketing claim that notarization gives users confidence software has been checked for malicious content, since known, actively distributed malware slipped through the review process at least twice. Given Shlayer's status as one of the most prevalent macOS malware families (per Kaspersky), and its role as an adware/PUP dropper, the notarization bypass represents a meaningful trust-model failure even though the payload itself is not a high-impact backdoor, primarily driving adware monetization rather than data theft or destructive impact.

Mentioned in this report

Malware BundloreOSX/Shlayer

Detection guidance

OSX Process Executing Embedded Binary via OpenSSL Decryption

ATT&CK T1140

Detects shell processes using openssl with AES-256-CBC to decrypt and execute binaries from image files or archives—characteristic of Shlayer's self-decrypting payload technique. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: OSX Process Executing Embedded Binary via OpenSSL Decryption
description: Detects processes spawning openssl with AES-256-CBC decryption piped
  to sh/bash for execution, a signature of Shlayer's embedded payload extraction and
  deobfuscation technique.
tags:
- attack.defense-evasion
- attack.t1140
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    CommandLine|contains|all:
    - openssl
    - aes-256-cbc
    - -d
    CommandLine|contains:
    - '| sh'
    - '| bash'
    - '| /bin/sh'
    - '| /bin/bash'
  filter_legitimate_decryption:
    Image|endswith:
    - /usr/bin/openssl
    - /opt/local/bin/openssl
    ParentImage|endswith:
    - /usr/bin/security
    - /usr/bin/codesign
  condition: selection and not filter_legitimate_decryption
falsepositives:
- Administrative scripts legitimately decrypting sensitive configuration files with
  openssl
- System administration tools performing encrypted archive extraction during software
  deployment
level: high
id: 3519e638-23c9-5eae-a78c-6d8bbaf21365
status: experimental
author: Vorant

Suspicious Chmod and Cleanup Following Binary Extraction on macOS

ATT&CK T1027

Detects sequential execution of chmod (to make extracted binaries executable) followed by cleanup/deletion commands—typical post-extraction behaviour in Shlayer's self-decrypting payload workflow. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Chmod and Cleanup Following Binary Extraction on macOS
description: "Detects shell processes executing chmod to set execute permissions on\
  \ files, followed by rm or cleanup commands that remove temporary artifacts\u2014\
  consistent with Shlayer's payload extraction and obfuscation-removal pattern."
tags:
- attack.defense-evasion
- attack.t1027
logsource:
  category: process_creation
  product: macos
detection:
  selection_chmod:
    CommandLine|contains:
    - chmod +x
    - chmod 755
    - chmod 777
  selection_cleanup:
    CommandLine|contains:
    - rm -f
    - rm -rf
    - shred
  selection_shell:
    Image|endswith:
    - /bin/sh
    - /bin/bash
    - /usr/bin/sh
    - /usr/bin/bash
  condition: selection_shell and (selection_chmod and selection_cleanup)
falsepositives:
- Installer scripts or package managers performing standard post-extraction cleanup
- System administration automation running legitimate privilege escalation workflows
level: medium
id: e838f52f-3ed1-5781-98da-14ac474f9409
status: experimental
author: Vorant

Execution of Notarized Installer with Bundlore-Associated Download Artifacts

ATT&CK T1204.002

Detects execution of notarized installer packages (bearing valid Apple code signatures) that subsequently spawn processes downloading or writing to domains/paths historically associated with Bundlore adware installation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Execution of Notarized Installer with Adware Download Behaviour
description: "Detects notarized macOS installers (bearing valid Apple Developer ID\
  \ signatures) that spawn child processes exhibiting adware-associated network behaviour\
  \ such as downloads to /tmp or execution of secondary payloads\u2014indicates trojanized\
  \ installer delivering adware."
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: macos
detection:
  selection_installer:
    Image|endswith:
    - .app/Contents/MacOS/InstallForceUpdate
    - .app/Contents/MacOS/Installer
    - /usr/sbin/installer
    SignatureStatus: valid
  selection_child_download:
    ParentImage|endswith:
    - .app/Contents/MacOS/InstallForceUpdate
    - .app/Contents/MacOS/Installer
    CommandLine|contains:
    - curl http
    - curl https
    - wget http
    - /tmp/
    - AdLoad
    - Bundlore
  condition: selection_installer and selection_child_download
falsepositives:
- Legitimate software installers downloading updates or additional components from
  vendor servers during post-installation setup
level: high
id: 486ed07c-7731-5bcf-87bd-0f9a7f3447e1
status: experimental
author: Vorant

1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x4E.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free