What was the purpose of the malware? a backdoor? a cryptocurrency miner? or something more insidious…Īlso, for each malware specimen, I’ve added a direct download link to the malware specimen, case you want to follow along with my analysis or dig into the malware more! 🛠️ Malware Analysis Tools & Tactics How it installed itself, to ensure it would be automatically restarted on reboot/user login. However at the end of this blog, I’ve included a section dedicated to these other threats, that includes a brief overview, and links to detailed write-ups.įor each malicious specimen covered in this post, we’ll identify the malware’s: Adware and/or malware from previous years, are not covered.

For more details about the 'Silver Sparrow' malware, read our earlier coverage.In this blog post, we focus on new Mac malware specimens or significant new variants that appeared in 2021. Malware targeting M1 Macs has simply been compiled to run natively on the Arm-based architecture of the M1 chip, now that Intel-based Macs are slowly being phased out.

Since February 2020, for example, Apple has required all Mac software distributed with a Developer ID outside of the Mac App Store to be submitted to Apple's notary service, an automated system that scans for malicious content and code-signing issues. Apple also reiterated that Red Canary found no evidence to suggest the malware has delivered a malicious payload to Macs that have already been infected.įor software downloaded outside of the Mac App Store, Apple said it has 'industry-leading' mechanisms in place to protect users by detecting malware and blocking it so it cannot run. Nonetheless, Apple has since informed MacRumors that it has revoked the certificates of the developer accounts used to sign the packages, preventing additional Macs from being infected.

After observing the malware for over a week, however, security firm Red Canary did not observe any final payload, so the exact threat to users remains a mystery. Given the name 'Silver Sparrow,' the malicious package is said to leverage the macOS Installer JavaScript API to execute suspicious commands. Over the weekend, we reported on the second known piece of malware compiled to run natively on M1 Macs.

How to detect silver sparrow malware