What it is
Silver Sparrow is a macOS malware family discovered in 2021 and notable for having packages built for both Intel Macs and Apple silicon. Researchers observed a downloader and persistence mechanism across many systems, although the analyzed campaigns did not reveal a clearly delivered final malicious payload.
How it works
The malware arrived in signed installer packages distributed outside normal trusted channels. Installation scripts created persistence through LaunchAgents and contacted cloud infrastructure to report system data and check for tasks. One variant used JavaScript within the installer, and the campaign included a self-removal mechanism.
Key points
The absence of an observed final payload does not make an unauthorized downloader harmless.
A valid developer signature shows who signed a package, not that the software will remain trustworthy forever.
Intel and Apple silicon support showed that malware authors were adapting quickly to new Mac hardware.
What to do
Remove unknown profiles, LaunchAgents, and packages only after preserving useful investigation details.
Update macOS and security tools so vendor protections include known campaign artifacts.
Review browser downloads and software installed outside the App Store or vendor site.
Reset credentials if the Mac showed additional information-stealing or remote-access activity.
What still applies
Silver Sparrow is a historical campaign, but its lessons remain useful for current Macs: signed software can still be abused, installers can run scripts before an app appears, and LaunchAgents can provide persistence. Keep Gatekeeper, XProtect, and macOS updates enabled; install software from trusted sources; and investigate unexpected profiles or login items. See downloader trojan and malware for related concepts.