Silver Sparrow is macOS malware that Red Canary described in February 2021: its installer packages ran code through the macOS Installer's JavaScript feature, and one version ran natively on M1 Macs. It checked in for instructions every hour but was never seen delivering a final payload; to check, look in ~/Library/LaunchAgents for agent.plist, init_agent.plist, verx.plist or init_verx.plist.
Last reviewed · 1 source
Also known as: SilverSparrow, Slisp
Silver Sparrow is an activity cluster Red Canary reported in February 2021. Its installer packages used the macOS Installer JavaScript API to run commands, something Red Canary hadn't seen in macOS malware before, and one binary was compiled for Apple's M1 chip. Using Malwarebytes data, Red Canary counted 29,139 Macs in 153 countries affected by the activity as of February 17, 2021; a subset ran one of the two malicious packages. Every hour a LaunchAgent fetched a file that told it what to run next, but no final payload was ever observed, and Apple revoked the developer certificates involved.
Installer packages (PKG) that run code through the macOS Installer JavaScript API
Two versions, one of them with a binary built for Apple's M1 chip
Distribution was never fully explained; many macOS threats like it come through malicious ads
LaunchAgents named agent.plist and init_agent.plist (version 1) or verx.plist and init_verx.plist (version 2) in ~/Library/LaunchAgents
A script at ~/Library/Application Support/verx_updater/verx.sh
A file named ._insu in ~/Library, which Red Canary says seems to tell the malware to remove itself
An installer package you can't account for in your Downloads folder
Delete agent.plist, init_agent.plist, verx.plist or init_verx.plist from ~/Library/LaunchAgents if they're there.
Remove ~/Library/Application Support/verx_updater and the installer package from your Downloads folder.
Restart the Mac and confirm the LaunchAgents haven't come back.
CoreLock's free scan includes a startup-items check. It can't confirm that every component is gone.
Be careful with installer packages from unknown sources: they can run code while installing
Keep macOS updated: Apple revoked the certificates Silver Sparrow used
Prefer apps from the Mac App Store or the developer's own site
What it can and can't do
Silver Sparrow persists through LaunchAgents in your user Library, which the startup-items check in CoreLock's free scan covers. It can't promise to catch every variant.
Trojan — Jamf Threat Labs described RustBucket in April 2023 and suspects a North Korean ...
Trojan — Lazarus Group is a North Korean state-sponsored group attributed to the Reconnai...
Trojan — Trend Micro described XCSSET in August 2020: it inserts code into local Xcode pr...
Nobody knows. Every hour it downloaded a file telling it what to do next, but in over a week of watching, Red Canary and its research partners never saw a final payload delivered.
Red Canary, using Malwarebytes data, counted 29,139 macOS endpoints in 153 countries affected by the activity as of February 17, 2021. Red Canary later clarified that only a subset ran one of the malicious packages; most had a related file check.
Apple revoked the developer certificates it was signed with, and no payload was ever seen. If you find its LaunchAgents, remove them.
Free, with no account: the scan checks your Downloads folder against a built-in malware-hash list and 19 YARA rules.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser