OSX/MacOffers is known for modifying the search engine in the victim's browser. Once installed, the apps would download and install the OSX/MacOffers adware.

The six new notarised apps posed as Flash installers. 'App notarization has been mandatory for all apps that want to run on Apple's newest macOS releases, like Catalina and Big Sur'. Once added to the GateKeeper whitelist, notarized apps can be opened and installed with a simple click, without any warnings or popups.

Once approved, Mac's in-built security screening software called 'Gatekeeper' allowed the app to run. The malware passed through the strict Apple 'notarisation' process that scans an app for security issues.