{"id":13069,"date":"2020-01-28T12:08:08","date_gmt":"2020-01-28T09:08:08","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=13069"},"modified":"2026-03-27T18:55:23","modified_gmt":"2026-03-27T15:55:23","slug":"shlay-them-all-thousands-of-websites-distribute-macos-malware","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/shlay-them-all-thousands-of-websites-distribute-macos-malware\/","title":{"rendered":"Shlay them all: thousands of websites distribute macOS malware"},"content":{"rendered":"

Kaspersky prevented attacks carried out by Shlayer, a malware Trojan family. Kaspersky Solutions for Mac prevented attacks on at least one out of every ten Mac devices, making this threat the most widespread for macOS users. A smart malware distribution system, it spreads via a partner network, entertainment websites and even Wikipedia, demonstrating that even users that only visit legal sites still need additional protection online.<\/strong><\/p>\n

Despite macOS traditionally considered to be a much safer and secure system, there are still cybercriminals trying their luck to profit from macOS users\u2019. Based on Kaspersky statistics, Shlayer – the most widespread macOS threat in 2019 – is a good example of that. It specializes in installation of adware \u2013 programs that terrorize users by feeding illicit ads, intercepting and gathering users\u2019 browser queries, and modifying search results to distribute even more advertising messages.<\/p>\n

Shlayer\u2019s share among all attacks on macOS devices registered by Kaspersky products in January – November 2019 amounted to almost a third (29.28%), with nearly all other top 10 macOS threats being the adware that Shlayer installs: AdWare.OSX.Bnodlero, AdWare.OSX.Geonei, AdWare.OSX.Pirrit and AdWare.OSX.Cimpli. Furthermore, ever since Shlayer was first detected, its infection algorithm has hardly changed, even though its activity barely decreased, making it an especially relevant threat that users need protection from.<\/p>\n

The infection process often consists of two phases \u2013 first the user installs Shlayer, then the malware installs a selected type of adware. Device infection however, starts with an unwitting user downloading the malicious program. In order to achieve installations, the threat actor behind Shlayer set up a malware distribution system with a number of channels leading users to download the malware.<\/p>\n

Shlayer is offered as a way to monetize websites in a number of file partner programs<\/a>, with relatively high payment for each malware installation made by American users, prompting over 1,000 \u2018partner sites\u2019 to distribute Shlayer. This scheme works as follows: a user looks for a TV series episode or a football match, and advertising landing pages redirect them to fake Flash Player update pages. From here the victim would download the malware. For each such installation, the partner who distributed links to the malware receives a pay-per-install payment.<\/p>\n

Example of Shlayer landing page<\/em><\/p>\n

Other schemes lead to a fake Adobe Flash update page redirecting users from various large online services with multi-million audiences, including YouTube, where links to the malicious website were included in video descriptions, and Wikipedia, where such links were hidden in the articles\u2019 references. Users that clicked on these links would also get redirected to the Shlayer download landing pages. Kaspersky researchers found 700 domains with malicious content, links to which were placed on a variety of legitimate websites.<\/p>\n

 <\/p>\n

YouTube video and Wikipedia page with malicious links in description<\/em><\/p>\n

Almost all of the websites which lead to a fake Flash Player contained content in English. This corresponds with the top countries where users have been affected by the threat \u2013 the USA (31%), Germany (14%), France (10%) and the UK (10%).<\/p>\n

Shlayer victims\u2019 geography, February 2018 \u2013 October 2019<\/em><\/p>\n

\u201cThe macOS platform is a good source of revenue for cybercriminals, who are constantly looking for new ways to deceive users, and actively use social engineering techniques to spread their malware. This case demonstrates that such threats can be found even on legitimate sites. Luckily for macOS users, the most widespread threats that target macOS currently revolve around feeding illicit advertising rather than something more dangerous, such as stealing financial data. A good web security solution can protect users from threats such as these, making the experience of searching the web safe and pleasant\u201d \u2013 says Anton Ivanov, Kaspersky security analyst.<\/p>\n

Kaspersky solutions detect Shlayer and its artefacts with the following verdicts:<\/h3>\n

HEUR:Trojan-Downloader.OSX.Shlayer.*<\/h3>\n

not-a-virus:HEUR:AdWare.OSX.Cimpli.*<\/h3>\n

not-a-virus:AdWare.Script.SearchExt.*<\/h3>\n

not-a-virus:AdWare.Python.CimpliAds.*<\/h3>\n

not-a-virus:HEUR:AdWare.Script.MacGenerator.gen<\/h3>\n

<\/h3>\n

Pages, artefacts and links for this Trojan family, as well as additional details of the findings, can be found on Securelist.com<\/a>.<\/h3>\n

<\/h3>\n

To reduce the risk of infection with Trojans such as Shlayer, Kaspersky recommends:<\/h3>\n