Flashback

Flashback, also known as OSX/Flashback and Flashfake, was a major Mac OS X malware family active in 2011 and 2012 and one of the largest macOS botnet outbreaks of its era. It initially spread by masquerading as an Adobe Flash Player installer and later evolved to use drive-by exploitation of Java vulnerabilities including CVE-2012-0507 and CVE-2011-3544, allowing infection when a user visited a compromised or malicious website hosting a crafted applet. The malware ultimately infected hundreds of thousands of Mac systems worldwide.

On infected hosts, Flashback installed a hidden Mach-O component and established user-level persistence through LaunchAgents. Later stages deployed a malicious dynamic library and abused DYLD_INSERT_LIBRARIES to force that library into browser processes such as Safari. In some variants, browser metadata was modified to ensure the library loaded automatically; in lower-privilege cases, user environment configuration was altered to achieve similar persistence. The injected library interposed CoreFoundation stream functions, enabling interception of both HTTP traffic and HTTPS traffic after decryption within the browser process.

Flashback’s operators used the malware primarily for web-traffic manipulation and ad-fraud-like activity. The malware collected Google search-related data and system identifiers, communicated with command-and-control infrastructure, and could alter web responses to simulate advertisement clicks. It supported resilient command-and-control through hard-coded and generated domains, cryptographic validation of downloaded payloads and server identities using embedded RSA keys, and a fallback discovery mechanism based on Twitter hashtags. The family also employed layered obfuscation and host-bound encryption, including RC4 keyed to the victim Mac’s hardware or platform UUID, which complicated off-host analysis. Some variants checked for security tools and removed themselves if analysis or monitoring software was present.

Flashback is closely associated with the 2012 Java exploitation wave against Apple systems and is notable for demonstrating large-scale botnet operations on Mac OS X. Apple later issued Java updates and a dedicated removal tool to mitigate infections.