OSX.Shlayer Malware Gains Apple Notarization
A fake Homebrew site (homebrew.sh) served OSX.Shlayer/Bundlore adware installers that Apple mistakenly notarized, letting them run as trusted software even on macOS Big Sur.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Researcher Patrick Wardle documents the first known case of malware bypassing Apple's code-notarization requirement, a security control introduced in macOS Catalina meant to ensure all distributed software is scanned by Apple before execution. A malicious site, homebrew.sh — a typosquat of the legitimate brew.sh — served fake Adobe Flash Player updates that led to installers ultimately identified as OSX.Shlayer, a highly prevalent macOS trojan that installs the Bundlore adware family. Unlike prior Shlayer campaigns which used unnotarized payloads blocked outright by macOS, these samples carried valid Apple notarization stamps, allowing them to execute without the usual warning/block dialog and lending them false legitimacy in the eyes of victims.
Analysis of the payloads showed a self-decrypting shell routine using openssl AES-256-CBC to extract and execute a hidden binary appended to an image file, consistent with known Shlayer techniques, alongside chmod and cleanup steps. Once notified, Apple revoked the abused Developer ID certificates on Aug 28, 2020, but the campaign persisted, re-signing and re-notarizing near-identical payloads under new developer identities within roughly 48 hours, demonstrating attacker agility in continuing to evade Apple's vetting pipeline.
The incident undercuts Apple's marketing claim that notarization gives users confidence software has been checked for malicious content, since known, actively distributed malware slipped through the review process at least twice. Given Shlayer's status as one of the most prevalent macOS malware families (per Kaspersky), and its role as an adware/PUP dropper, the notarization bypass represents a meaningful trust-model failure even though the payload itself is not a high-impact backdoor, primarily driving adware monetization rather than data theft or destructive impact.
Mentioned in this report
Detection guidance
OSX Process Executing Embedded Binary via OpenSSL Decryption
A behavioural hunt for the technique in general.
Detects shell processes using openssl with AES-256-CBC to decrypt and execute binaries from image files or archives—characteristic of Shlayer's self-decrypting payload technique. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: OSX Process Executing Embedded Binary via OpenSSL Decryption
description: Detects processes spawning openssl with AES-256-CBC decryption piped
to sh/bash for execution, a signature of Shlayer's embedded payload extraction and
deobfuscation technique.
tags:
- attack.stealth
- attack.t1140
logsource:
category: process_creation
product: macos
detection:
selection:
CommandLine|contains|all:
- openssl
- aes-256-cbc
- -d
CommandLine|contains:
- '| sh'
- '| bash'
- '| /bin/sh'
- '| /bin/bash'
filter_legitimate_decryption:
Image|endswith:
- /usr/bin/openssl
- /opt/local/bin/openssl
ParentImage|endswith:
- /usr/bin/security
- /usr/bin/codesign
condition: selection and not filter_legitimate_decryption
falsepositives:
- Administrative scripts legitimately decrypting sensitive configuration files with
openssl
- System administration tools performing encrypted archive extraction during software
deployment
level: high
id: 3519e638-23c9-5eae-a78c-6d8bbaf21365
status: experimental
author: Vorant
Suspicious Chmod and Cleanup Following Binary Extraction on macOS
A behavioural hunt for the technique in general.
Detects sequential execution of chmod (to make extracted binaries executable) followed by cleanup/deletion commands—typical post-extraction behaviour in Shlayer's self-decrypting payload workflow. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Chmod and Cleanup Following Binary Extraction on macOS
description: "Detects shell processes executing chmod to set execute permissions on\
\ files, followed by rm or cleanup commands that remove temporary artifacts\u2014\
consistent with Shlayer's payload extraction and obfuscation-removal pattern."
tags:
- attack.stealth
- attack.t1027
logsource:
category: process_creation
product: macos
detection:
selection_chmod:
CommandLine|contains:
- chmod +x
- chmod 755
- chmod 777
selection_cleanup:
CommandLine|contains:
- rm -f
- rm -rf
- shred
selection_shell:
Image|endswith:
- /bin/sh
- /bin/bash
- /usr/bin/sh
- /usr/bin/bash
condition: selection_shell and (selection_chmod and selection_cleanup)
falsepositives:
- Installer scripts or package managers performing standard post-extraction cleanup
- System administration automation running legitimate privilege escalation workflows
level: medium
id: e838f52f-3ed1-5781-98da-14ac474f9409
status: experimental
author: Vorant
1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x4E.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,570 reports from 147 sources, 725 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs