Double check the sender email address to make sure it is not spoofed. To reiterate, don't open attachments from unknown sources. For one, Apple has revoked the certificate, which makes it nearly impossible to make it through the installation process without you knowing about it. It is unlikely, at this point, that Snake will slither through your Mac's backdoor. Lastly, change your administrator password to ensure that you're backdoor is rekeyed so the hackers can't get back in. Select Delete to confirm that you want to delete the certificate.Select Delete Certificate from the drop down options.Right or Control + click on the Certificate.Select the certificate named Adobe Flash Player installer with the signed certificate issued to Addy Symonds.Next, delete the stolen/fake signed Apple Developer certificate.

If you think you might have managed to accidentally install the Snake trojan onto your Mac, you can find and delete the following files:

Specific to the Snake trojan, avoid downloading any zip files with the name Install Adobe Flash. If you're still unsure, confirm with the sender by texting, calling or sending a separate email asking if the attachment is legit. Click on the sender's name to view the email address it was sent from to make sure it's not a spoofed email. Check the sender address to make sure it is from an address you recognize. How you can protect yourself against SnakeĪs noted above, the fake/stolen developer certificate that allowed Snake to get a pass from Gatekeeper has already been revoked, so it's likely that, even if you download the zip file and try to open the app, your built-in security program will say, 'Nope Dope!'īut to refresh best practices, if you receive an email with an attachment at all, do some due diligence to make sure it's from a legitimate source. Interestingly, once the installation is complete, Flash is actually installed on the Mac, making it even more difficult to tell that it's a trojan. If such a password is provided, the behavior continues to be consistent with the real thing. If the app is opened, it will immediately ask for an admin user password, which is typical behavior for a real Flash installer. The file, named Install Adobe Flash, will appear to be an Adobe Flash installer (Say what you will about Flash, but there are still a lot of people that have to use it for school or work). If you don't invite it into your home, it can't attack you.

Adobe flash player mac