Forest Global Training Partners

Cyber Risks · Volexity Blog

Real News, Fake Flash: Mac OS X Users Targeted

Summary: Volexity found that attackers breached a Georgian media outlet's website and used JavaScript on its Georgian-language index page to target Mac OS X visitors who had not previously visited the site and were not running Google Chrome. Qualifying visitors were routed through an iframe to a fake "Flash Player Critical Update" page that pushed a zipped .app, GetFlashPlayer.app, which installed itself under the user's Library/Safari folder, persisted via a LaunchAgent named com.GetFlashPlayer.plist, and beaconed to downloadarchives.servehttp[.]com on TCP port 7777 every second until connected. The binary was signed with an Apple Developer certificate issued to aleks papandopulo (TeamIdentifier SN6EU36WE9) and appears to be a newer OSX/Leverage.A variant written in Real Basic that grants an unrestricted command shell.

What you should know: The malware carried a valid Apple Developer signature, so Gatekeeper's identified-developer check would not have blocked it, and the backdoor beacons once per second on non-standard port 7777, giving an attacker a full command shell on any Mac that clicked Open.

Read the original at Volexity Blog ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026