OSX/Shlayer can use bash scripts to check the macOS version, download payloads, and extract bytes from files. OSX/Shlayer uses the command "sh -c tail -c +1381..." to extract bytes at an offset from a specified file. OSX/Shlayer uses the "curl -fsL "$url" >$tmp_path" command to download malicious payloads into a temporary directory.