Security researchers have discovered that Apple’s macOS app notarization process has mistakenly approved a piece of malware disguised as a Flash installer.
Apple requires Mac app developers — even those outside of the App Store — to submit apps for notarization, which checks them for security issues and malicious code. If they don’t pass notarization, apps will be blocked by Gatekeeper.
But macOS security researcher Patrick Wardle and Twitter user Peter Dantini have found that at least one piece of malicious code appears to slipped through Apple’s safeguards.
On Friday, Dantini noticed that a Flash installer adware campaign actually featured malicious code that was notarized by Apple. The effect of that notarization is that the installer wouldn’t be blocked by the built-in Gatekeeper security function. If a user clicked on it, the installer would simply run and deliver its payload on a system.
Wardle confirmed that the approved code contained within the malware has been used by the Shlayer adware, which has been said to be the top malicious threat to Mac users. Shlayer works by intercepting web traffic and replacing ads with its own, fraudulently making money for operators.
Read more at AppleInsider.com