Bundlore

Bundlore is an extremely prevalent adware that targets macOS systems by bundling unwanted applications with legitimate software installers. It often masquerades as popular software updaters and installers, deceiving users into installing additional unwanted programs. Once installed, Bundlore injects advertisements into web browsers, redirects user searches, and collects sensitive browsing data. Bundlore is sometimes dropped by macOS malware Shlayer.

Symptoms

You might observe the following artifacts associated with this threat:

• Unexpected advertisements appearing on websites where they previously did not occur.
• Browser homepage and search engine settings altered without user consent.
• Frequent browser redirects to unfamiliar or unwanted websites.
• Decreased system performance and increased resource usage.
• Installation of additional unwanted applications or browser extensions without user knowledge.
• Detections of another threat, Trojan: macOS/Shlayer, which is known to drop this threat.

Technical Breakdown

Bundlore is distributed through deceptive means such as:

• Fake Software Updates: Posing as legitimate software updates, prompting users to input their sensitive passwords.
• Bundled Installations: Packaged with legitimate software installers, deceiving users into inadvertently installing potentially unwanted programs (PUP).

Bundlore performs the following actions:

• Persistence Mechanism: Installs into login items so that it runs at each startup, ensuring persistence on the system.
• Browser Manipulation: Modifies browser settings to change the default search engine, and redirect user searches to generate ad revenue.
• Data Collection: May collect browsing data to share with third parties.

Bundlore has continually evolved over time, with variants employing ever-changing techniques to evade detection and removal. Some versions have been observed modifying the sudoers file to remove the password requirement for privilege escalation.

Next Steps

Kandji Endpoint Detection & Response (EDR) automatically removes detected threats when file monitoring is set to Protect.

While the malicious file is removed, it can leave behind artifacts that need to be cleaned manually.

In the future, avoid downloading and installing software from torrent sources or untrusted websites. Ensure that all applications are obtained from official and reputable sources to maintain system integrity and security.