The Sneaky Simple Malware That Hits Millions of Macs

[jpak]

https://www.wired.com/story/macos-shlayer-trojan-adware/

The popular misconception that Macs don’t get viruses has become a lot less popular in recent years, as Apple devices have weathered their fair share of bugs. But it’s still surprising that the most prolific malware on macOS—by one count, affecting one in 10 devices—is so relatively crude.

This week, antivirus company Kaspersky detailed the 10 most common threats its macOS users encountered in 2019. At the top of the list: the Shlayer Trojan, which hit 10 percent of all of the Macs Kaspersky monitors, and accounted for nearly a third of detections overall. It’s led the pack since it first arrived in February 2018.

You’d think that such prevalence could only be achieved by comparable sophistication. Not so! “From a technical viewpoint Shlayer is a rather ordinary piece of malware,” Kaspersky wrote in its analysis. In fact, it relies on some of the oldest tricks in the books: convincing people to click on a bad link, then pushing a fake Adobe Flash update. Even the trojan’s payload turns out to be ho-hum: garden variety adware.

Shlayer’s brilliance, it turns out, lies less in its code than its method of distribution. The operators behind the trojan reportedly offer website owners, YouTubers, and Wikipedia editors a cut if they push visitors toward a malicious download. A complicit domain might prompt a phony Flash download, while a shortened or masked link in a YouTube video’s description or Wikipedia footnote might initiate the same. Kaspersky says it counted more than 1,000 partner sites distributing Shlayer. One individual, Kaspersky says, currently owns 700 domains that redirect to Shlayer download landing pages.

<more>

[Fiendish Thingy]

1. You still have to enter your administrative password to install

That’s the final protection Macs offer from malware that Windows machines don’t - if you’re not vigilant about where you download stuff from, you’ll get burned.

Flash is the worst offender- I have it disabled on all but one app, and then only to watch YouTube, no other websites.

[Big Blue Marble]

2. Who uses Flash anymore? N/T

[Jane Austin]

3. What do you use instead?

Thanks.

[Big Blue Marble]

4. My experience is that few sites I use ask for it.

When they do, I just leave. If I really want to see it, I can always go to iOS which works great without it Flash.
I decided several years ago Flash had too many vulnerabilities to run on my computers.

[Jane Austin]

6. Thanks for this answer.

By iOS, do you mean the Macintosh operating system?

Thanks.

[Big Blue Marble]

8. Actually, I mean the iPhone and iPad.

I do use a Mac computer but do not have Flash. I really seldom encounter sites that want it.
They are always sites I can skip. As I said, it is just not worth the risk.

Some sites that do not work well with Macs wlll work just fine with iAds and iPhones when you
really want to access the video which is hardly ever.

[Jane Austin]

9. Thanks for that clarification.

I really appreciate ite.

[TheBlackAdder]

5. Kapersky and Russian Intelligence have connections. I wouldn't put any Kapersky product on my PC.

[denbot]

7. This.