Shlayer malware abusing Gatekeeper bypass on macOS
jamf.com · Undated · Licence: not cleared; local research copy only
CVEs this report names
1 CVE- CVE-2021-30657Apple macOS Unspecified Vulnerability68.5%Top 0.66%70.6priority
Where it names them
CVE-2021-30657 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
This new variant found no longer requires the right-click method since the malware comes packaged in the format required to abuse CVE-2021-30657.
Due to the file path layout in which this script is set up, double-clicking the install icon executes the script held within 1302.app and bypasses the checks performed by Gatekeeper, described in further detail in CVE-2021-30657.
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.