I know a very long article ... a lot of information you should know and what you can do or can't !!
:-/

https://blog.confiant.com/osx-shlayer-new-shurprise-unveiling-osx-tarmac-f965a32de887

 

Thanks..
For those that didn't read: lookout for fake Flashplayer installers, lookout (don't use) Magnet links on Torrent. Lookout in General.
And my own contribution: Run Malwarebytes on a regular basis, have an adblocker, I use Wipr.

https://www.malwarebytes.com
https://giorgiocalderolla.com/wipr.html

 

why not using Magnet link on torrent? could you clarify that?
Thx in advance

 

"OSX/Shlayer has been a very common macOS malware this year, most of the time delivered through bad ads. First discovered in 2018, OSX/Shlayer came via a fake Flash Player updater appearing in bitTorrent file sharing websites when a user attempts to select a link to copy a torrent magnet link."

 

Etrecheck is good too.

 

it looks like the OSX/Tarmac is a very powerful tool, I think you've read about or heard about this before. https://www.welivesecurity.com/2019/06/20/loudminer-mining-cracked-vst-software/

OSX/Tarmac in plugins is a possibility ?

 

Thanks, No didn't know about this. 137 compromised VST plugins, for both Mac & Win! This sucks balls..
Hard to tell if you're infected, let alone to clean a system..

 

Great analysis, thanks!

 

I saw a similar mining malware in a Roland Cloud package I was given by a mate. Thankfully Malwarebytes removed it pretty quickly - I saw some random app trying to get out in Little Snitch which alerted me to the issue. There was an update.dmg hidden within the main DMG package which added the cryptominer.