#HIJACK MAC SOFTWARE#

In a clever attempt to mask its presence from detection, the malware hides a zipped executable at the bottom of the script itself, as seen above in Figure E.Ī secondary command, “tail -c 58853 $0 | funzip -1uD9jgw > $ - Write the newly unzipped file to the disk at the aforementioned temp file location. This is an example of a user searching for “Alexa and Disney” on Google Search in April 2021. In a real-world example, users could potentially stumble upon malware when searching for any commonly used terms. Since most search engines automate the indexing and ranking, this leads to them inadvertently publishing links to the malicious or hijacked sites hosting malware.

This is an approach where the malicious actors spreading the malware create web pages with content tailored to appear in search results for common queries or hijack legitimate websites without the knowledge of the owner. Previous variants of this malware are known to spread via poisoned search engine results - this variant is no exception. This will work on any system running macOS versions 10.15 to 11.2. When the dmg is mounted and the application is double-clicked, the combination of a script-based application with no ist file executes without any quarantine, signature or notarization verification.The application can then be placed in a dmg for distribution.For this to work, the script name must match the application name and they must not create an ist file. (example:myapplication.app/Contents/MacOS/myapplication where “myapplication” is a bash script). An attacker manually crafts an application bundle by using a script as the main executable.The details behind how the vulnerability can be abused by attackers are: The Jamf Protect detection team identified samples found to be abusing this vulnerability as early as January 9th, 2021. The major difference, in this case, is that the variant has been repackaged to use a format necessary for carrying out the Gatekeeper bypass vulnerability. In fact, both malware samples are nearly identical.

The variant observed has strong ties to a sample previously written about by Intego Security. To make the situation more urgent, the Jamf Protect detections team observed this exploit being used in the wild by a variant of the Shlayer adware dropper.

#HIJACK MAC SOFTWARE#

All of which are technologies in place to prevent unapproved software from running on macOS. In a recent blog post, Objective-See covered that prior to macOS 11.3, an attacker could craft a fake application bundle using a script as the primary executable allowing them to bypass File Quarantine, Gatekeeper and Notarization on the macOS platform.

Hijack mac