Quick question concerning malicious flash player.dmg files....

I was on news sites (on the likes of CNN, BBC, etc.,) the other night when suddenly my tab automatically opened a new tab with a long string of non-sensical url, and started automatically downloading a flashplayer.dmg file to my downloads folder. I double clicked on the file to see what it was: just an image of what seemed to be the Flash Player logo. I didn’t install it, and instead after reading online that this was malware I closed the file, deleted the file, ejected it from my desktop, and cleared out my trash can.

My question is whether there was any harm/possible consequences in double-clicking the file? Or would I have had to actually install the file for anything bad to come out of this?

  • Of course software can be malicious. Just because the name says “organic sugar” it could be “rat poison” so you’d need to fingerprint the exact installer you installed and if you gave it admin credentials by running it and/or typing your password. If you did grant admin access - you might want to wipe and reinstall if you need to be sure. What sort of answer are you looking for? What I wrote above? – bmike Aug 3 '18 at 19:19
  • Sorry, I should have phrased my question better. I didn’t reach the point of granting admin access to the .dmg file - I just double clicked it from the Downloads folder, which brought me to a window that I could’ve proceeded to install the fake Flash Player with. But I didn’t. I was curious as to whether simply double-clicking it like I did was enough to execute the virus. – Ben Aug 3 '18 at 19:27
  • Cool - I’ll provide a general answer then as opposed to a specific answer for a specific file and a specific OS version. – bmike Aug 3 '18 at 19:43

There are occasionally programs that exploit a bug in the OS to infect your macOS without typing an admin password, and those generally are patched quickly and depend on you not having the current latest security updates installed.

Most run of the mill software won’t cause any harm, run any code, make any changes just because you downloaded a DMG.

If you are super at risk of harm due to malware (human rights worker, journalist (especially one critical of the following powerful groups), a potential target of a nation state or large corporation, or just a public figure - think globally recognized celebrity like Beyoncé) you should assume you’re compromised and seek professional help to be sure you’re secure or educated about your risk tolerance and operational security practices.

Most people like me and my family, relatives, work colleagues that aren’t involved in super secret work - I would say if you didn’t install anything and you don’t see anything going crazy like browser redirects then you could safely trash the file and perhaps be sure Safari doesn’t open “safe” attachments and be sure your backups are set.

If a regular security posture user wants to check that malware was installed, I like both a scanner for known attacks and something that looks for persistent processes being hidden.

So to summarize, just clicking is enough to compromise a Mac with the right malware and the right version of macOS. Even if you have a fully patched Mac - the term “zero-day” acknowledges that there are exploits that have no warning and nothing you can do to prevent them from escalating their privileges and changing your Mac without a password entered. They are rare, but do exist in practice as well as in theory.

  • Thank you very much for your help! I actually did scan with Malwarebytes, and after a few threats were neutralized, it says that everything is clear. So I suppose I’m pretty safe by this point? – Ben Aug 3 '18 at 19:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .