www.itfunk.orgwww.itfunk.orgwww.itfunk.org
  • Home
  • Tech News
    Tech NewsShow More
    The Hidden Sabotage: How Malicious Go Modules Quietly Crashed Linux Systems
    6 Min Read
    Agentic AI: The Next Frontier in Cybersecurity Defense and Risk​
    5 Min Read
    Cybersecurity CEO Arrested for Allegedly Installing Malware on Hospital Computers: A Stark Reminder of Insider Threats
    8 Min Read
    Cybercriminals Hijack Google’s Reputation
    7 Min Read
    Apple and Google Join Forces to Patch Actively Exploited Zero-Day Vulnerabilities in iOS and macOS
    5 Min Read
  • Cyber Threats
    • Malware
    • Ransomware
    • Trojans
    • Adware
    • Browser Hijackers
    • Mac Malware
    • Android Threats
    • iPhone Threats
    • Potentially Unwanted Programs (PUPs)
    • Online Scams
  • How To Guides
    How To GuidesShow More
    Nviqri Someq Utils Unwanted Application
    4 Min Read
    How to Deal With Rbx.fund Scam
    4 Min Read
    How to Jailbreak DeepSeek: Unlocking AI Without Restrictions
    4 Min Read
    Why Streaming Services Geo-Restrict Content?
    10 Min Read
    Anonymous France Ransomware: A Comprehensive Guide
    9 Min Read
  • Product Reviews
    • Hardware
    • Software
  • IT/Cybersecurity Best Practices
    IT/Cybersecurity Best PracticesShow More
    Affordable Endpoint Protection Platforms (EPP) for Small Businesses
    5 Min Read
    Outlaw Malware: A Persistent Threat Exploiting Linux Servers
    4 Min Read
    CVE-2024-48248: Critical NAKIVO Backup & Replication Flaw Actively Exploited—Patch Immediately
    6 Min Read
    How to Jailbreak DeepSeek: Unlocking AI Without Restrictions
    4 Min Read
    Microsoft Patches Critical Security Flaws in Azure AI Face Service and Microsoft Account
    5 Min Read
  • FREE SCAN
  • Cybersecurity for Business
Search
  • ABOUT US
  • TERMS AND SERVICES
  • SITEMAP
  • CONTACT US
© 2023 ITFunk.org. All Rights Reserved.
Reading: ZShlayer: New Mac Malware Heavily Obfuscates Zsh Scripts to Bypass Security Tools
Share
Notification Show More
Font ResizerAa
www.itfunk.orgwww.itfunk.org
Font ResizerAa
  • Tech News
  • How To Guides
  • Cyber Threats
  • Product Reviews
  • Cybersecurity for Business
  • Free Scan
Search
  • Home
  • Tech News
  • Cyber Threats
    • Malware
    • Ransomware
    • Trojans
    • Adware
    • Browser Hijackers
    • Mac Malware
    • Android Threats
    • iPhone Threats
    • Potentially Unwanted Programs (PUPs)
    • Online Scams
  • How To Guides
  • Product Reviews
    • Hardware
    • Software
  • IT/Cybersecurity Best Practices
  • Cybersecurity for Business
  • FREE SCAN
Follow US
  • ABOUT US
  • TERMS AND SERVICES
  • SITEMAP
  • CONTACT US
© 2023 ITFunk.org All Rights Reserved.
www.itfunk.org > Blog > Cyber Threats > Mac Malware > ZShlayer: New Mac Malware Heavily Obfuscates Zsh Scripts to Bypass Security Tools
Mac Malware

ZShlayer: New Mac Malware Heavily Obfuscates Zsh Scripts to Bypass Security Tools

ITFunk Research
Last updated: October 23, 2023 6:56 pm
ITFunk Research
Share
ZShlayer: New Mac Malware Heavily Obfuscates Zsh Scripts to Bypass Security Tools
SHARE

Researchers have recently discovered a new macOS malware variant dubbed ZShlayer which can mask itself to sneak past security tools and compromise target machines. ZShlayer, which is a variant of Shlayer, does not conform to the original Shlayer signatures and can go unnoticed by some malware scanners. Earlier versions of the Shlayer malware were presented as a shell script executable on a removable .DMG disk image. This new version is delivered as part of a standard Apple application bundle inside the .DMG.

Phil Stokes, a threat researcher at SentinelOne, who’s research discovered the strain, stated in a blog post:“Although bypassing Apple’s Notarization checks is obviously a headline grabber, this new variant of Shlayer utilizes heavily obfuscated Zsh scripts and is in fact far more prolific in the wild.” 

Stokes had discovered the ZShlayer while hunting for threats on VirusTotal. Stokes also told the websiteThe Daily Swig: “Implications are that users’ security tools may not recognize the initial infected application bundle as malware as it doesn’t conform to Shlayer signatures.”

It is also apparent that ZShlayer infections are currently isolated to users who have downloaded tainted software outside the Apple Ecosystem. Stokes also adds: “Most ZShlayer droppers that I saw are in trojanized cracked software, so the usual caveat applies about avoiding downloading pirated versions of products.”

Shlayer malware posed as an Adobe Flash software update and was first discovered in February 2019. It resurfaced after it was found to have the ability to slip past Apple’s notarizing checks. The campaign was initially spotted by a Twitter user named Peter Dantini, who passed his findings on to Mac security expert Patrick Wardle.

This attack represents the first time any malicious code has gained Apple’s notarization “stamp of approval.”Apple promptly revoked the developer code-signing certificate abused in the Shlayer campaign.

If you are still having trouble, consider contacting remote technical support options.

You Might Also Like

ResolverRAT Virus
SNOWLIGHT Malware (macOS Dropper)
Remove PT.updd Malware from macOS
How to Remove DynamicAlgorithm Adware from Your Mac
How to Remove Hp-quicker
TAGGED:Mac malwareMalware

Sign Up For Daily Newsletter

Be keep up! Get the latest breaking news delivered straight to your inbox.
By signing up, you agree to our Terms of Use and acknowledge the data practices in our Privacy Policy. You may unsubscribe at any time.
Share This Article
Facebook Copy Link Print
Share
Previous Article Zeppelin Ransomware Makes a Comeback Using New Trojan to Avoid Detection 
Next Article Sodinokibi Ransomware: a ransomware-as-a-service
Leave a Comment

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Think You're Infected? Let's Find Out – FAST.
SpyHunter identifies viruses, ransomware, and hidden threats in under a minute.
🛡️ Scan Your Device for Free
✅ Free Scan Available • ⭐ Catches malware instantly
//

Check in Daily for the best technology and Cybersecurity based content on the internet.

Quick Link

  • ABOUT US
  • TERMS AND SERVICES
  • SITEMAP
  • CONTACT US

Support

Sign Up for Our Newesletter

Subscribe to our newsletter to get our newest articles instantly!

 

www.itfunk.orgwww.itfunk.org
© 2023 www.itfunk.org. All Rights Reserved.
  • ABOUT US
  • TERMS AND SERVICES
  • SITEMAP
  • CONTACT US
Welcome Back!

Sign in to your account

Username or Email Address
Password

Lost your password?