Shlayer is a macOS trojan that installs adware, usually delivered as a fake Adobe Flash Player update on streaming, torrent and look-alike sites. Flash Player is discontinued, so any page telling you to install or update it is a lure; delete the download and check for apps and browser extensions you didn't add.
Last reviewed · 2 sources
Also known as: OSX.Shlayer, Shlayer Trojan
Shlayer is a macOS dropper that installs adware and potentially unwanted programs. Kaspersky named it the most common macOS threat of 2019, at almost 30% of the macOS detections its products made that year (Securelist, January 2020). Shlayer gained notoriety for being accidentally notarized by Apple in 2020, allowing it to bypass Gatekeeper entirely.
Fake Adobe Flash Player update prompts on streaming and torrent sites
Malvertising and redirects on legitimate websites leading to fake update pages
Look-alike domains: in 2020 a typo of the Homebrew site served it as a Flash update (Objective-See)
Poisoned search results that lead to fake download portals
You recently clicked a Flash Player update prompt on a website
Several apps you didn't install appeared at about the same time
Browser searches redirected to a search engine you didn't choose
Many more ads across the sites you visit
Remove any recently downloaded DMG or PKG file related to Flash Player from your Downloads folder and empty the Trash.
Check /Applications and ~/Applications for apps you don't recognize. Shlayer's job is to install other adware, so expect more than one.
Remove unfamiliar plist files from ~/Library/LaunchAgents, /Library/LaunchAgents and /Library/LaunchDaemons, especially ones created around the time of the fake update.
Reset the homepage, search engine and extensions in Safari, Chrome and Firefox to undo what the adware changed.
CoreLock's free scan checks startup items and compares files in your Downloads folder against a built-in malware-hash list and 19 YARA rules. It can't promise to find every adware payload Shlayer installed.
Adobe Flash Player is discontinued, so any prompt to update it is a lure
An ad blocker cuts down the malvertising redirects that lead to fake updates
Update software only through the App Store or the app's built-in updater
Check the address bar before you download: look-alike domains are a common trick
What it can and can't do
Shlayer arrives as a .dmg or .pkg in your Downloads folder, which CoreLock's free Downloads check compares against a built-in malware-hash list and 19 YARA rules; a match is shown as worth a look and is never quarantined on its own. The startup-items check covers the adware it installs afterwards, and neither check can promise to catch every variant.
Kaspersky named it the most common macOS threat of 2019, and in August 2020 Objective-See found Shlayer payloads that Apple had notarized by mistake. Flash Player itself has been discontinued since the end of 2020, but the same fake-update trick works with any app name.
In August 2020 Patrick Wardle of Objective-See found Shlayer payloads, offered as a Flash Player update on a look-alike of the Homebrew website, that had passed Apple's automated notarization scan. Apple revoked the developer certificates after he reported them.
Shlayer is a dropper: it exists to install other adware, which then injects ads into web pages, redirects your searches and adds browser extensions that keep coming back.
Free, with no account: the scan checks your Downloads folder against a built-in malware-hash list and 19 YARA rules.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser