Loading malware…
Shlayer is a widely prevalent macOS malware family best known as a first-stage trojan downloader and dropper used to install additional unwanted or malicious payloads, especially adware. First reported in 2018, it became one of the most common macOS threats and was heavily associated with ad fraud operations targeting Mac users. Shlayer commonly masquerades as an installer or software update, especially fake Adobe Flash Player updates, and has also been distributed through malicious websites, hijacked domains, malvertising chains, and affiliate-driven traffic redirection from legitimate high-traffic sites.
Its primary role is to gain execution on macOS, retrieve a second-stage payload, and launch it. Observed variants have been implemented in shell scripts, Python, Zsh, and Mach-O binaries. Across variants, Shlayer commonly uses native macOS and Unix utilities to download, decrypt, unpack, and execute follow-on payloads, and has shown repeated use of obfuscation and anti-analysis measures. Some variants query quarantine metadata, inspect mounted disk images, or hide encrypted configuration data inside modified DMG structures. A notable evolution, tracked as OSX/Shlayer.F, stores AES-encrypted configuration data inside the DMG file structure without breaking normal mounting behavior.
Shlayer has historically delivered adware families including Bundlore, Cimpli, AdLoad, Pirrit, Bnodlero, and Geonei. These payloads have been used for intrusive advertising, browser search interception, traffic redirection, and related monetization activity. In some campaigns, the downstream adware established persistence and manipulated browser behavior through extensions, proxying, or HTTPS interception components. Shlayer itself has also been associated with persistence-enabling behavior in broader infection chains and with techniques intended to evade Gatekeeper, notarization checks, file quarantine controls, and signature-based detection.
Distribution has been strongly tied to social-engineering lures and malvertising infrastructure. Fake update landing pages, especially Flash-themed lures, were a hallmark of Shlayer campaigns, and operators used rapidly rotating domains, cloud-hosted payload infrastructure, and large affiliate networks to scale delivery and frustrate IOC-based blocking. Shlayer activity has been linked to malvertising ecosystems such as VeryMal and to distribution sources associated with Yosec. Apple security controls were notably challenged by this family; Shlayer was also reported as the first known malicious code notarized by Apple, and it has been observed abusing Gatekeeper bypass opportunities, including CVE-2021-30657.
Shlayer targets macOS systems and has been observed affecting sectors including education, where it was identified among prevalent malware impacting U.S. K-12 institutions. Although often discussed alongside adware, Shlayer is more accurately characterized as malware because it relies on deception, obfuscation, payload delivery, and execution of secondary components to establish a foothold and monetize infected hosts.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2021-30657 April 26 macOS Gatekeeper bypass abused by Shlayer malware
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The bad actor is known for running large scale fake Flash update campaigns that are hosted on .icu domains by way of display ad auto-redirects: VeryMal Fake Flash Update — Shlayer Trojan
Yosec — ... They are a major source of distribution for the notorious Shlayer trojan: OSX/Shlayer ...
23 distinct techniques documented for this family, organized by ATT&CK tactic.
Note the decrypted string that corresponds to commands, OSX/Shlayer.F executes them via popen() function.
The malicious shell scripts used by Shlayer and Bundlore are usually malvertising-focused adware bundlers using shell scripts in the kill chain to download and install an adware payload.
The most recent Shlayer variant is Trojan-Downloader.OSX.Shlayer.e... written in Python rather than Bash... the seemingly standard installer turns out to be a Python script.
After unpacking the archive, the main Python script uses the chmod tool to assign the file 84cd5bba3870 permission to run in the system. After that, the trojan runs the downloaded and unpacked application package using the built-in open tool.
The bash script in these variants decrypt the next stage encrypted blobs containing the next stage bash scripts using openssl with base64, Advanced Encryption Standard (AES), CBC (Cipher Block Chaining) to thwart security scanners.
Shlayer is a trojan downloader, which spreads via fake applications that hide its malicious code... Cimpli masquerades as a useful Mac utility (i.e., “Any Search”).
After that, the Trojan runs the downloaded and unpacked application package using the built-in open tool, and deletes the downloaded archive and its unpacked contents.
encrypted string ref in function 0x100020a50 decoded to : defaults read /System/Library/CoreServices/SystemVersion.plist ProductVersion
Next, the main script generates a unique user and system ID, and also collects information about the version of macOS in use.
33 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as commodity macOS malware whose techniques were echoed or improved upon by the APT32 backdoor delivery chain.
macOS malware family cited as using LaunchAgents/LaunchDaemons for persistence.
macOS malware family cited as using curl to download secondary payloads and bypass Gatekeeper by avoiding quarantine attributes.
A Mac-focused trojan delivered via fake Flash update malvertising campaigns and auto-redirects. In this report, the campaign uses Firebase/Firestore-hosted payloads, fingerprinting, obfuscation, and redirects to deliver the Shlayer binary.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.