“Though we haven’t observed Silver Sparrow delivering additional malicious payloads yet, its forward-looking M1 chip compatibility, global reach, relatively high infection rate, and operational maturity suggest Silver Sparrow is a reasonably serious threat, uniquely positioned to deliver a potentially impactful payload at a moment’s notice.

Optimization for the M1 chip combined with things like the infection rate and maturity is what worries Red Canary researchers: This doesn’t mean that M1 Macs are specifically targeted, but the malware can equally affect M1 Macs and Intel Macs. This makes it the second piece of malware discovered that is optimized for Apple Silicon, with the first coming earlier this week. The Silver Sparrow malware also runs natively on Apple’s M1 chip. Its use of Amazon Web Services and the Akamai content delivery network ensures the command infrastructure works reliably and also makes blocking the servers harder. The malware has been found in 153 countries with detections concentrated in the US, UK, Canada, France, and Germany. That makes it hard to analyze installation package contents or the way that package uses the JavaScript commands. The malicious binary is more mysterious still, because it uses the macOS Installer JavaScript API to execute commands. Silver Sparrow has been found found on 29,139 macOS endpoints around the world:

The malware also comes with its own “self-destruct” mechanism, but there’s no evidence that it has yet been used. “The lack of a final payload suggests that the malware may spring into action once an unknown condition is met,” the repot explains. Therefore, the ultimate goal of this malware is unknown. Red Canary researchers say that this “Silver Sparrow” malware forces infected Macs to check a control sever once per hour, but the actual threat remains a mystery.Īs reported by Ars Technica, the researchers have yet to observe an actual “delivery of any payload” on the infected machines. Security researchers have discovered a previously undetected piece of malware affecting Mac users around the world, including the new M1-powered Macs.

How to detect silver sparrow malware