---
title: 1 Million Macs Exposed to Malvertising Scam
description: Instead of hiding the malicious code in plain sight, Shlayer sucks it in from Firebase
---

[News - Confiant ](https://www.confiant.com/news)

# [1 Million Macs Exposed to Malvertising Scam](https://www.confiant.com/news/1-million-macs-exposed-to-malvertising-scam)

 Written by [Tom's Guide](https://www.confiant.com/news/author/toms-guide) | Mar 21, 2019 4:00:00 AM

A [malvertising campaign](https://www.tomsguide.com/us/malvertising-what-it-is,news-19877.html) has been targeting Macs since at least mid-January, with at least a million machines exposed, security firm [Confiant](https://blog.confiant.com/shlayer-purveyor-verymal-renounces-steganography-in-favor-of-google-firebase-as-malvertisers-shift-3a6119ecba24) said in a blog posting this week.

The malicious ads lure users into updating their Adobe Flash players—but that update is really a downloader called Shlayer that opens up the Mac to even more malware. To evade malware screeners, the ads first load normally, but then draw in malicious content from a Firebase, a Google-hosted online data repository designed for mobile-app makers.

Unfortunately, not that many Mac antivirus brands recognized the Shlayer malware signature yet. As of this writing on Thursday afternoon (March 21), the corporate siblings [Avast](https://www.tomsguide.com/reviews/avast-free-antivirus-mac) and [AVG](https://www.tomsguide.com/us/avg-antivirus-mac,review-4662.html) did, as did [Avira](https://www.tomsguide.com/us/avira-free-antivirus-mac,review-2976.html) and [Bitdefender](https://www.tomsguide.com/reviews/bitdefender-antivirus-mac) and their licensees (Emsisoft, F-Secure, GData and Qihoo 360), plus a couple of others. But dozens of other antimalware engines listed on the [VirusTotal page](https://www.virustotal.com/#/file/063bbebb64e3b4f5f5844ca3cf46b69dc195e74a692bc9a977d35bed7edc0e3a/detection) for Shlayer's signature let the malware slip by.

Our advice would be to ignore any pop-up windows suggesting that you update Flash Player, especially if you're using Safari, which Shlayer seems to prefer. (Go to the official Flash update page at [https://get.adobe.com/flashplayer/](https://tracker.tradedoubler.com/click?p=265883&a=3009146&g=22913796&epi=tomsguide-us-8824563212321181000&url=https%3A%2F%2Fget.adobe.com%2Fflashplayer%2F) instead.) Alternately, you could use [an ad blocker](https://www.tomsguide.com/round-up/best-adblockers-privacy-extensions).

**Read Complete Article:** [https://www.tomsguide.com/us/mac-malvertising-google-firebase,news-29700.html](https://www.tomsguide.com/us/mac-malvertising-google-firebase,news-29700.html)

[View full post](https://www.confiant.com/news/1-million-macs-exposed-to-malvertising-scam)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Tom's Guide"
  },
  "dateModified" : "2023-06-29T09:23:19.311Z",
  "datePublished" : "2019-03-21T04:00:00Z",
  "headline" : "1 Million Macs Exposed to Malvertising Scam",
  "image" : {
    "@type" : "ImageObject",
    "height" : 486,
    "url" : "https://f.hubspotusercontent20.net/hubfs/5994026/Imported_Blog_Media/Confiant%20Logo-2-Nov-04-2021-10-10-59-58-PM.png",
    "width" : 508
  },
  "mainEntityOfPage" : "https://www.confiant.com/news/1-million-macs-exposed-to-malvertising-scam",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "News"
  }
}
```