OSX/Shlayer

Description

OSX/Shlayer (a.k.a. CrossRider) is a trojan and adware family for macOS that spreads through fake software updates and browser extensions to install additional unwanted software. It rose to prominence through fake Flash player update pages on compromised and scam websites, and researchers ranked it among the most common macOS threats for years. Its installers drop adware payloads that hijack search settings and inject advertisements, and its distribution chains have repeatedly survived App Store and browser security improvements.

Stats

First seen: January 2022
Last seen: October 2026

Also known as

CrossRiderCrossriderZShlayer

MITRE ATT&CK techniques

15 techniques across 7 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.004Unix Shell
T1204User Execution
- T1204.002Malicious File

TA0003 Persistence

T1176Software Extensions
- T1176.001Browser Extensions

TA0004 Privilege Escalation

T1548Abuse Elevation Control Mechanism
- T1548.004Elevated Execution with Prompt

TA0005 Stealth

T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location
T1140Deobfuscate/Decode Files or Information
T1564Hide Artifacts
- T1564.001Hidden Files and Directories
- T1564.011Ignore Process Interrupts
- T1564.009Resource Forking

TA0007 Discovery

T1082System Information Discovery
T1083File and Directory Discovery

TA0011 Command and Control

T1105Ingress Tool Transfer

TA0112 Defense Impairment

T1222File and Directory Permissions Modification
- T1222.002Linux and Mac Permissions
T1553Subvert Trust Controls
- T1553.001Gatekeeper Bypass

Alert name variants

Alert Name	Engine
Adware.Crossrider.EA	AV
Adware.JS.Crossrider.B	AV
Adware.JS.Crossrider.C	AV
Adware.JS.Crossrider.D	AV
Adware.JS.Crossrider.E	AV
Adware.JS.Crossrider.G	AV
Adware.JS.Crossrider.M	AV
Adware.JS.Crossrider.N	AV
Adware.JS.Crossrider.O	AV
Adware.JS.Crossrider.P	AV
Adware.JS.Crossrider.R	AV
Adware.JS.Crossrider.S	AV
Adware.MAC.Crossrider.B	AV
Adware.MAC.Crossrider.D	AV
Dropped:Adware.Crossrider.EB	AV
Gen:Variant.Adware.Crossrider.11	AV
Gen:Variant.Adware.CrossRider.15	AV
Gen:Variant.Adware.CrossRider.27	AV
Gen:Variant.Application.Crossrider.1	AV
MacOS.Trojan.ZShlayer	ATP Sandbox Adv. Heuristics
MemScan:Adware.CrossRider.DP	AV
Win32.Browser.Crossrider	ATP Sandbox Adv. Heuristics
Win32.Browser.CrossRider	ATP Sandbox Adv. Heuristics

Related families

Bundlore InvisiMole PlugX XCSSET NETWIRE