Mysterious malware infecting Apple Silicon Macs has no payload - yet
More malware affecting Apple Silicon Macs has been uncovered, but researchers have spotted that it is lacking a malicious payload, for the moment.
It seems that there may be more malware aimed at Apple's M1-based Macs than previously thought. Following the initial reports of the first M1 malware found in the wild, it seems that there are more infections of malware, but of a particularly toothless variety.
Early in February, researchers from Red Canary discovered a strain of macOS malware that used LaunchAgent to make its presence, much like some other forms of malware. What was of interest to the researchers was that the malware behaved differently from typical adware, due to how it used JavaScript for execution.
The malware cluster, named by the researchers as "Silver Sparrow," also involved a binary compiled to work with M1 chips. This made it malware that would potentially target Apple Silicon Macs.
Further research from researchers at VMware Carbon Black and Malwarebytes determined it was likely that Silver Sparrow was a "previously undetected strain of malware." As of February 17, it had been detected in 29,139 macOS endpoints across 153 countries, with the bulk of infections residing in the US, the UK, Canada, France, and Germany.
At the time of publication, the malware hasn't been used to deliver a malicious payload to victim Macs, though that could change in the future. Due to the compatibility with M1, the "relatively high infection rate" and the operational maturity of the malware, it was deemed to be a serious enough threat that is "uniquely positioned to deliver a potentially impactful payload at a moment's notice," prompting a public disclosure.
Two versions of the malware were discovered, with one version's payload consisting of a binary affecting Intel-based Macs only, while the other was a binary that was compiled for both Intel and M1 architectures. The payload is seemingly a placeholder, as the first version opens a window that literally says "Hello, World!" and the second states "You did it!"
![An example of the included binary [via Red Canary]](https://photos5.appleinsider.com/gallery/40419-77860-image3-l.jpg)
An example of the included binary [via Red Canary]
If it were malicious malware, the payload could potentially allow the same or similar payload instructions to affect both architectures from a single executable.
The mechanism for the malware worked around files titled "update.pkg" and "updater.pkg," taking the guise of installers. They take advantage of the macOS Installer JavaScript API to execute the suspicious commands.
This is a behavior that is sometimes seen with legitimate software and not malware, which usually uses preinstall or post-install scripts for command execution.
Once successful, the infection attempts to check a specific URL for a downloadable file, which could contain further instructions or a final payload. A week of monitoring the malware resulted in no visible final payload being made available, which could still change in the future.
There are multiple questions left unanswered to the researchers about Silver Sparrow. These include where the initial PKG files came to be used for infecting systems, and elements of the malware's code that seems to be part of a wider toolset.
"The ultimate goal of this malware is a mystery," Red Canary admits. "We have no way of knowing with certainty what payload would be distributed by the malware, if a payload has already been delivered and removed, or if the adversary has a future timeline for distribution."
There is also the question of the inclusion of the "Hello World" executables, as the binary won't run unless a victim actively searched for it and ran it, rather than running automatically. The executables suggest this could be an under-development malware, or that an application bundle was needed to make the malware seem legitimate to other parties.
It seems that there may be more malware aimed at Apple's M1-based Macs than previously thought. Following the initial reports of the first M1 malware found in the wild, it seems that there are more infections of malware, but of a particularly toothless variety.
Early in February, researchers from Red Canary discovered a strain of macOS malware that used LaunchAgent to make its presence, much like some other forms of malware. What was of interest to the researchers was that the malware behaved differently from typical adware, due to how it used JavaScript for execution.
The malware cluster, named by the researchers as "Silver Sparrow," also involved a binary compiled to work with M1 chips. This made it malware that would potentially target Apple Silicon Macs.
Further research from researchers at VMware Carbon Black and Malwarebytes determined it was likely that Silver Sparrow was a "previously undetected strain of malware." As of February 17, it had been detected in 29,139 macOS endpoints across 153 countries, with the bulk of infections residing in the US, the UK, Canada, France, and Germany.
At the time of publication, the malware hasn't been used to deliver a malicious payload to victim Macs, though that could change in the future. Due to the compatibility with M1, the "relatively high infection rate" and the operational maturity of the malware, it was deemed to be a serious enough threat that is "uniquely positioned to deliver a potentially impactful payload at a moment's notice," prompting a public disclosure.
Two versions of the malware were discovered, with one version's payload consisting of a binary affecting Intel-based Macs only, while the other was a binary that was compiled for both Intel and M1 architectures. The payload is seemingly a placeholder, as the first version opens a window that literally says "Hello, World!" and the second states "You did it!"
An example of the included binary [via Red Canary]
If it were malicious malware, the payload could potentially allow the same or similar payload instructions to affect both architectures from a single executable.
The mechanism for the malware worked around files titled "update.pkg" and "updater.pkg," taking the guise of installers. They take advantage of the macOS Installer JavaScript API to execute the suspicious commands.
This is a behavior that is sometimes seen with legitimate software and not malware, which usually uses preinstall or post-install scripts for command execution.
Once successful, the infection attempts to check a specific URL for a downloadable file, which could contain further instructions or a final payload. A week of monitoring the malware resulted in no visible final payload being made available, which could still change in the future.
There are multiple questions left unanswered to the researchers about Silver Sparrow. These include where the initial PKG files came to be used for infecting systems, and elements of the malware's code that seems to be part of a wider toolset.
"The ultimate goal of this malware is a mystery," Red Canary admits. "We have no way of knowing with certainty what payload would be distributed by the malware, if a payload has already been delivered and removed, or if the adversary has a future timeline for distribution."
There is also the question of the inclusion of the "Hello World" executables, as the binary won't run unless a victim actively searched for it and ran it, rather than running automatically. The executables suggest this could be an under-development malware, or that an application bundle was needed to make the malware seem legitimate to other parties.
Comments
Flash had myriad exploitable vulnerabilities, where unauthorized code could break free of Flash’s constraints, escalate privilege and run on the native system. This isn’t like that. Particular JavaScript virtual machines/interpreters may have similar vulnerabilities, but this isn’t one of those cases. This is more like welcoming the bad guys in directly.
Besides that, looking for some exotic and mysterious methods of contamination wouldn't help much. Malware in macOS spreads almost always through the weakest link in the security chain: the user.
People would be surprised to learn how many food products come from China, for example. And the law in Canada says that a food product can be labelled "made in Canada" if at least 51% of the price of the final product was spent in Canada. The loophole is that that price includes the price of the packaging. So in many cases food that is grown in China is labelled "made in Canada".
In my life I have never yet met another person who shares this value of mine. I've heard many people who take pride in buying products from their own country, but never people who take pride in buying from "free countries." So I'm braced for a lot of critics here.
Microsoft I believe see 94% of threats once. For Windows it's all about protection against software vulnerabilities and zero-day.
There is feedback from VMWare and MalwareBytes so it's clearly a known threat in the AV vendor community.
All this really is then is a reminder to macOS owners (including myself) that they need some form of decent malware protection now.
History has shown us that trusting hardware and OS vendors exclusively is insufficient.
https://redcanary.com/blog/clipping-silver-sparrows-wings/
1) not download from the App Store exclusively.
4) even then it won’t work unless you have disabled security settings to allow any application to launch, as opposed to App Store or known developers. You can only do this on an m1 (big sur) Mac via the command line.