Mysterious malware infecting Apple Silicon Macs has no payload - yet

It seems that there may be more malware aimed at Apple's M1-based Macs than previously thought. Following the initial reports of the first M1 malware found in the wild, it seems that there are more infections of malware, but of a particularly toothless variety.

Early in February, researchers from Red Canary discovered a strain of macOS malware that used LaunchAgent to make its presence, much like some other forms of malware. What was of interest to the researchers was that the malware behaved differently from typical adware, due to how it used JavaScript for execution.

The malware cluster, named by the researchers as "Silver Sparrow," also involved a binary compiled to work with M1 chips. This made it malware that would potentially target Apple Silicon Macs.

Further research from researchers at VMware Carbon Black and Malwarebytes determined it was likely that Silver Sparrow was a "previously undetected strain of malware." As of February 17, it had been detected in 29,139 macOS endpoints across 153 countries, with the bulk of infections residing in the US, the UK, Canada, France, and Germany.

At the time of publication, the malware hasn't been used to deliver a malicious payload to victim Macs, though that could change in the future. Due to the compatibility with M1, the "relatively high infection rate" and the operational maturity of the malware, it was deemed to be a serious enough threat that is "uniquely positioned to deliver a potentially impactful payload at a moment's notice," prompting a public disclosure.

Two versions of the malware were discovered, with one version's payload consisting of a binary affecting Intel-based Macs only, while the other was a binary that was compiled for both Intel and M1 architectures. The payload is seemingly a placeholder, as the first version opens a window that literally says "Hello, World!" and the second states "You did it!"

If it were malicious malware, the payload could potentially allow the same or similar payload instructions to affect both architectures from a single executable.

The mechanism for the malware worked around files titled "update.pkg" and "updater.pkg," taking the guise of installers. They take advantage of the macOS Installer JavaScript API to execute the suspicious commands.

This is a behavior that is sometimes seen with legitimate software and not malware, which usually uses preinstall or post-install scripts for command execution.

Once successful, the infection attempts to check a specific URL for a downloadable file, which could contain further instructions or a final payload. A week of monitoring the malware resulted in no visible final payload being made available, which could still change in the future.

There are multiple questions left unanswered to the researchers about Silver Sparrow. These include where the initial PKG files came to be used for infecting systems, and elements of the malware's code that seems to be part of a wider toolset.

"The ultimate goal of this malware is a mystery," Red Canary admits. "We have no way of knowing with certainty what payload would be distributed by the malware, if a payload has already been delivered and removed, or if the adversary has a future timeline for distribution."

There is also the question of the inclusion of the "Hello World" executables, as the binary won't run unless a victim actively searched for it and ran it, rather than running automatically. The executables suggest this could be an under-development malware, or that an application bundle was needed to make the malware seem legitimate to other parties.