Malware developers have apparently again succeeded in smuggling their software through Apple’s notarization service: For the second time in around six weeks, Apple has accidentally authenticated an adware targeting macOS, according to a manufacturer of antivirus tools. The malware called OSX / MacOffers was discovered by a security researcher during an analysis of cracked software – “in the wild”. Adware manipulates browser search engine MacOffers is supposed to change the search engine in the user’s browser and was disguised as an alleged installer of Adobe Flash – like practically all adware circulating on a large scale for macOS. Intego writes that Apple withdrew the certificate used by the malware provider after a short time. Fraudsters usually hardly care, they then fall back on a different developer ID.

The adware used steganography and hid a .zip file with the malware in a JPEG – that’s probably why it is has also been certified by Apple’s notarization service.

Thanks to Apple notarization, software – or in this case malware – can be easily opened, even on Macs with the current version Version 10. 15 Catalina and macOS 11 Big Sur. Before the start, a dialog indicates that the software has been downloaded from the Internet. “Apple has checked them for malware and found none,” it says.

Notarization promises malware check Apple’s notarization service is actually supposed to secure the direct sales of Mac software outside of the Mac App Store. Developers have to send their apps signed with a developer certificate to Apple for authentication, which is now mandatory for signed software.

The notarization should be automated and quick, emphasized the manufacturer. It is k