Additionally, Shlayer uses masquerading and obfuscation techniques that clearly demonstrate an intention to hide. While Shlayer has historically been heavily tied to ad fraud, the nature of the malware and mechanisms for persistence provide all the infrastructure to quickly turn Shlayer into a delivery mechanism for more nefarious payloads. (This behavior was consistent with the variant identified as ZShlayer by SentinelOne.) In addition, Shlayer moved to using the AWS Cloudfront CDN and S3 data storage buckets for infrastructure, eschewing their own custom-named domains that would occasionally rotate out.

While executing the beginning of the same script, it would issue tail commands to separate the bytes of the payload from the script for execution. For example, midway through the year we observed Shlayer begin to obfuscate portions of its payloads within a single shell script. Most of the traditional Shlayer TTPs remained the same throughout 2020, with only slight variations. Shlayer and Bundlore are similar but have slightly different download, execution, and deobfuscation patterns that all involve curl, unzip, and openssl with certain command lines. Bundlore is frequently delivered as a second-stage payload, which often results in overlaps in public reporting in which certain TTPs are tracked under Bundlore by some teams and under Shlayer by others. Shlayer commonly delivers payloads such as AdLoad and Bundlore.

In August 2020, Objective-See reported that Shlayer was the first malicious code to be notarized by Apple, granting it privileges to execute with default configurations of macOS Gatekeeper. The trojan masquerades as an installer for applications like Adobe Flash Player and executes numerous macOS commands to deobfuscate code and install adware with persistence mechanisms. Shlayer is a macOS malware family associated with ad fraud activity through the distribution of adware applications.

Adobe flash player version 1140 for mac