Security researcher Patrick Wardle reports that Apple accidentally approved an app for its macOS that contained what Kaspersky regarded as the biggest threat to Macs in 2019, a trojan downloader called Shlayer. Flash really isn’t needed anymore, but if you do need it, make sure to only download it from Adobe’s official website.Apple approved nasty Shlayer malware that mimicked Adobe Flash Player update for macOS. Additionally, for most users fake Adobe Flash Players are easy to avoid. Other than that, the malware doesn’t seem to do much damage to your system. On macOS 10.13: sudo profiles remove -identifier

In this case, the identifier is earlier, type: sudo profiles -R -p

If you’re on macOS 10.12 or earlier, use the command: sudo profiles -LĪlthough this works on macOS 10.13, another command may be better: sudo profiles list Luckily, removing it is fairly straightforward and involves a couple of Terminal commands. You can’t change it via Safari preferences, but you can find the profile by going to System Preferences > Profiles. This configuration profile forces Safari and Chrome (if you have it installed) to always open a page at. This is due to a configuration profile, which is a method that IT admins use to control the behavior of Macs in bulk, like in a company. As you install it, it automatically installs Advanced Mac Cleaner, which uses Siri’s voice to tell you it found a problem.īut behind the scenes, it locks Safari’s homepage to a Crossrider domain, and can’t easily be changed.

Pretty typical for macOS and nothing we haven’t seen before.

This strain of Crossrider comes in the form of a fake Adobe Flash Player installer. It’s Mac Flash malware and different than the original breed because it installs certain configuration profiles to stay persistent ( via Malwarebytes). A variant of the Crossrider adware has been spotted in the wild.

Fake adobe flash on mac malware