![\"\"](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2016\/04\/fake-flash-600x300.jpeg\")
A recent malware distribution campaign dubbed “VeryMal” leverages an ancient technique called steganography\u2014the hiding of secret information in plain sight\u2014to distribute Mac malware.<\/p>\nA recent malware distribution campaign dubbed “VeryMal” leverages an ancient technique called steganography\u2014the hiding of secret information in plain sight\u2014to distribute Mac malware.<\/p>\n
The VeryMal campaign was caught distributing OSX\/Shlayer<\/a>, which was originally discovered by Intego researchers one year ago.<\/p>\n OSX\/Shlayer malware still masquerades as a fake Flash Player.<\/p>\n Although the concept of steganography<\/a> has been around for hundreds of years, it is not something we see in a lot of Mac malware campaigns.<\/p>\n The VeryMal campaign used some cleverly crafted JavaScript code to look for secret information stored within a seemingly innocuous JPEG image file. The hidden data tells the site where to go to find the malware.<\/p>\n To the naked eye, the image looks like a plain, white rectangle. Credit: Stein<\/a><\/p>\n Why go to all this trouble? In theory, using steganography or other obfuscation<\/a> techniques makes it more difficult for endpoint protection and network monitoring software to determine that something suspicious might be happening.<\/p>\n In practice, however, this tricky tactic does not prevent well-designed antivirus software like VirusBarrier X9 from keeping users safe.<\/p>\n Users of Intego VirusBarrier X9 (part of Intego’s\u00a0Mac Premium Bundle X9<\/a>\u00a0suite) or\u00a0Flextivity<\/a>\u00a0were already protected<\/strong> from this threat before the discovery of the VeryMal campaign.<\/p>\n If you aren’t a VirusBarrier X9 user<\/strong> and you think you might have downloaded a fake Flash Player, you can scan your Mac with VirusBarrier Scanner<\/a> (available for free<\/a> on the Mac App Store) to check for any infections. After you scan your Mac, your best bet to prevent future infections<\/strong> is to get VirusBarrier X9<\/a>, which includes real-time scanning<\/a> functionality\u2014a critical feature to block malware before it can harm your Mac.<\/p>\n If you’re a systems administrator and want to check for potentially infected Macs on your network, you can check whether any Macs phoned home to one of the following sites (remove the space before each .com):<\/p>\n Any Mac that made contact with those sites around mid-January 2019 may be infected with Shlayer malware.<\/p>\n For more technical details about the malware, you can read Eliya Stein’s write-up<\/a>.<\/p>\n A recent malware distribution campaign dubbed “VeryMal” leverages an ancient technique called steganography\u2014the hiding of secret information in plain sight\u2014to distribute Mac malware. The VeryMal campaign was caught distributing OSX\/Shlayer, which was originally discovered by Intego researchers one year ago. OSX\/Shlayer malware still masquerades as a fake Flash Player. What makes this malware campaign unique? […]<\/p>\n","protected":false},"author":14,"featured_media":52474,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[190],"tags":[3928],"class_list":["post-85531","post","type-post","status-publish","format-standard","has-post-thumbnail","category-malware","tag-osxshlayer"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t![\"\"](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2018\/02\/Shlayer_A_download_step_2_Chrome-1024x572.jpg\")
<\/p>\nWhat makes this malware campaign unique?<\/h3>\n
![\"\"](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2019\/01\/sscc_jpg-steganographic-image-screenshot-via-blog_confiant_com-cropped.png\")
<\/p>\nIs my Mac infected?<\/h3>\n
How sysadmins can find potentially infected Macs<\/h3>\n
veryield-malyst .com\r\ns.ad-pixel .com\/sscc.jpg<\/pre>\n
How can I learn more?<\/h3>\n
![\"\"](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2017\/10\/ios9-podcasts-app-tile-150x150.png\")
<\/a>Each week, we talk about the latest Apple security news on the Intego Mac Podcast<\/strong>, so be sure to subscribe<\/a> to make sure you don’t miss any episodes. You’ll also want to subscribe to our e-mail newsletter<\/strong> and keep an eye here on The Mac Security Blog<\/strong> for updates.<\/p>\n","protected":false},"excerpt":{"rendered":"