Loading story…
Kaspersky reported that the Shlayer Trojan remained the most prevalent macOS threat for nearly two years, accounting for almost 30% of macOS detections in 2019 and affecting roughly one in ten protected Mac users. The malware, tracked in a newer Python-based form as Trojan-Downloader.OSX.Shlayer.e, collected system information and then retrieved a ZIP archive from command-and-control servers to download and run second-stage payloads.
Shlayer was used primarily to deliver adware families including Cimpli, which installed malicious Safari extensions, added a trusted certificate, intercepted HTTPS traffic with mitmdump, and redirected searches to attacker-controlled domains for advertising revenue. Researchers said the campaign spread through fake Adobe Flash update pages, affiliate schemes, YouTube video descriptions, and expired domains referenced by legitimate sites such as Wikipedia, with infections heavily concentrated in the United States due to affiliate payouts tied to U.S.-based installs.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Kaspersky published an analysis of the newer Trojan-Downloader.OSX.Shlayer.e variant, describing how it collected system information and downloaded second-stage payloads from command-and-control infrastructure. The report also detailed its role in delivering adware such as Cimpli, which installed malicious Safari extensions, added a trusted certificate, intercepted HTTPS traffic, and redirected searches for monetization.
Kaspersky reported that Shlayer accounted for nearly 30% of all macOS detections in 2019 and affected roughly one in ten protected Mac users. Its widespread success was driven largely by social engineering and broad distribution rather than advanced technical sophistication.
During its active spread, Shlayer was propagated through fake Adobe Flash update pages, affiliate programs, YouTube video descriptions, and expired domains linked from legitimate sites including Wikipedia. The campaign was heavily oriented toward U.S. users, aligning with affiliate payment incentives for U.S.-based installations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 15 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers compromised a prominent Georgian news website and used its Georgian-language pages as a watering hole to selectively infect macOS visitors. Malicious JavaScript profiled users by operating system, browser, and prior visits, then redirected qualifying Safari users to an attacker-controlled fake Adobe Flash update that delivered a signed macOS application, `GetFlashPlayer.app`. The malware established persistence with a LaunchAgent, opened the legitimate Adobe Flash website as a decoy, and communicated with command-and-control infrastructure over TCP port `7777`. Volexity identified the payload as a newer variant of **OSX/Leverage.A**, a macOS backdoor that expanded beyond earlier versions by providing unrestricted shell access. Reporting on the malware family and related analysis highlighted code-signing details, file hashes, network indicators, and host- and network-based detection opportunities, giving defenders concrete artifacts to hunt for on potentially exposed Apple systems.
Aug 14, 2026
Palo Alto Networks Unit 42 reported that a cybercrime cluster tracked as **CL-CRI-1089** is running a large macOS malvertising operation that delivers a new Flutter-based backdoor called **FlutterShell**. The campaign uses hundreds of Google Ads placed through verified shell companies to lure users in Anglophone and Western European markets into downloading trojanized applications posing as legitimate desktop tools, including variants identified as **PodcastsLounge**, **PDF-Brain**, and **PDF-Ninja**. Once installed, FlutterShell can execute shell commands, manipulate files, and exfiltrate environment variables, while also altering Google Chrome preferences to hijack browser traffic for ad monetization. Researchers said the malware relies on a **WebView** JavaScript-to-native bridge that lets operators host malicious logic remotely and update behavior without recompiling the binary, making static analysis harder and enabling rapid changes in the campaign. Unit 42 linked FlutterShell to earlier CL-CRI-1089 activity on macOS, including **JSCoreRunner**, and to Windows malware families **RecipeLister** and **Calendaromatic**, indicating an expanding cross-platform operation. The findings also echo prior reporting on macOS adware loaders such as **Bundlore**, underscoring the continued use of deceptive software distribution and browser-focused monetization techniques against Apple users.
Jun 29, 2026
Attackers compromised **MacUpdate** and distributed trojanized versions of popular macOS applications including **Firefox**, **OnyX**, and **Deeper**, replacing legitimate downloads with installers that deployed a cryptocurrency miner. Researchers reported the malware as **OSX.CreativeUpdate** / **OSX.CreativeUpdater**, noting that the fake installers were built with **Platypus**, used decoy applications to reduce suspicion, and in some cases exposed operational mistakes when those decoys failed to launch properly. Once installed, the malware established persistence through **LaunchAgents** and ran under a malicious `sysmdworker` process that ultimately launched **`minergate-cli`** to mine **Monero** via connections to **minergate.com**. The campaign also relied on deceptive infrastructure, including lookalike domains such as `titaniumsoftware.org` and `download-installer.cdn-mozilla.net`, while hosting payloads on `public.adobecc.com`, underscoring the risk posed by compromised software distribution channels and third-party download sites for macOS users.
Jun 29, 2026