Loading story…
A reverse-engineering analysis found that an apparent wave of more than 40,000 daily macOS malware samples was not a broad new outbreak but a VirusTotal sandbox feedback loop caused by a self-mutating EvilQuest/ThiefQuest variant. The malware repeatedly opened its own file via argv[0], located the Mach-O __cstring section, and rewrote obfuscated strings on disk after decrypting and re-encrypting them. As a result, each execution produced a slightly different binary with the same __text hash but altered string data, leading VirusTotal to classify and resubmit each mutated copy as a new sample. The activity was traced back to initial submissions from Germany, and the analyzed variant was identified as an actively developed build linked to the hardcoded C2 address 159.65.147.28.
The research concluded that the surge exposed a weakness in macOS sandbox handling for self-modifying binaries and risked wasting analysis capacity and storage. Early antivirus detection for the malware was low before improving as signatures were updated. Supporting that analysis, a public GitHub repository released shortly afterward provided a Go-based EvilQuest/ThiefQuest string deobfuscation tool designed to decrypt individual or bulk-obfuscated strings from samples, building on the reverse-engineering work and earlier community tooling to aid further malware analysis.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
A GitHub repository for an EvilQuest/ThiefQuest strings decryptor and deobfuscator by Pedro Vilaça was published with usage for decrypting a single string or all strings in a file. The repository referenced the prior day's "EvilQuest revisited" analysis and Scott Knight's earlier Python implementation.
Pedro Vilaça published findings that the apparent flood of more than 40,000 daily macOS malware samples was not a massive campaign but a VirusTotal macOS sandbox feedback loop triggered by a new EvilQuest/ThiefQuest variant. He showed the binaries shared identical code sections while mutating encrypted strings on disk between executions.
Daily sample counts on VirusTotal rose sharply beginning on September 5 as the malware repeatedly rewrote its own __cstring section and was resubmitted as new binaries. The article cites 47,782 samples on September 6 and similar volumes on subsequent days.
Two likely patient-zero EvilQuest/ThiefQuest samples were first seen on VirusTotal under the submission name "ookcucythguan," uploaded from Germany. These submissions appear to have started the later chain of self-mutating samples.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 37 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SentinelOne published a technical walkthrough showing how analysts can reverse the macOS malware **EvilQuest** and defeat its anti-analysis behavior with **radare2**. The guide demonstrates how to prepare a malware sample in a controlled macOS virtual machine, attach the debugger with elevated privileges, inspect functions and cross-references, and rename imported library calls to clarify the sample’s execution flow. The tutorial focuses on dynamically bypassing EvilQuest checks without patching the binary, including skipping function execution and altering register return values during debugging. SentinelOne highlights routines such as `_is_virtual_mchn` and `user_info`, and notes that one of the checks appears closer to sleep-based sandbox evasion than true virtual-machine detection. The malware, first seen in 2020 and initially described as ransomware, is characterized in the report as ineffective in the wild and possibly a proof of concept or early-stage project.
Aug 14, 2026
Multiple macOS malware campaigns used BitTorrent and pirated software installers to deliver ransomware or ransomware-themed payloads, showing that Apple systems were repeatedly targeted through fake cracks and trojanized apps. **KeRanger** was distributed through an infected Transmission BitTorrent client installer, while **Patcher** (`OSX/Filecoder.E`) posed as cracks for software such as Microsoft Office for Mac and Adobe Premiere Pro. Patcher encrypted files in user folders and mounted external or network volumes by placing them into password-protected ZIP archives, deleted the originals, and dropped `README!.txt` ransom notes demanding **0.25 BTC** via a hardcoded wallet and email address. Later analysis of **EvilQuest/ThiefQuest** found that its ransomware behavior was largely a cover for more destructive activity. The malware was spread through trojanized pirated macOS applications, established persistence, opened a reverse shell, checked for security tools, and downloaded Python-based payloads to steal files from `/Users`, including documents, certificates, source code, databases, and cryptocurrency wallets. Researchers also found major flaws in some of these campaigns: Patcher had no practical way to return encryption keys to victims even if they paid, and EvilQuest used suspiciously static ransom infrastructure, reinforcing that pirated software channels remained a recurring infection vector and that victims faced both irreversible data loss and data theft.
Aug 14, 2026
Researchers documented several malware campaigns that used fake software and trojanized packages to deliver credential theft and remote-access payloads. On Windows, a fake *Resident Evil 9* mod from GitHub triggered a `curl | cmd` chain that deployed hidden batch, JavaScript, portable Node.js, portable Python, and an in-memory Go payload with browser theft, wallet targeting, hVNC-style control, webcam-related code, and exfiltration via Wormhole/B2 and Gofile; a separate fake AI video player installer led through Python bytecode, shellcode, and protected .NET loaders to **PureRAT**, which persisted through the `Run` key and communicated over authenticated WebSockets with `agent.sm-veo.com`. Another Windows campaign, dubbed **Operation TURB00**, used a Go loader and decoy console program to launch **Vidar** in memory, steal browser and application data, and install persistence through `agt.dll` and the `CadenceOptimizer` service running under `svchost` as `LocalSystem`. On macOS, analysts reversed a fully undetected **Atomic macOS Stealer (AMOS)** sample distributed as a signed DMG, bypassed its anti-VM checks, and recovered an AppleScript payload that stole browser data, wallet files, Telegram Desktop data, documents, and system information before exfiltrating to `95.164.53.3/contact`. In the software supply chain, a malicious PyPI package, `nhmpy 2.4.7`, masqueraded as NumPy while using a `.pth` file and an obfuscated JavaScript payload executed through Bun to harvest developer, cloud, CI/CD, registry, SSH, wallet, messaging, VPN, and AI-assistant secrets; it then spread using stolen GitHub tokens and malicious GitHub Actions workflows. Separately, a public Windows local privilege escalation exploit named **REDSUN** showed how attackers could turn standard-user access into `NT AUTHORITY\SYSTEM` by abusing a TOCTOU flaw involving NTFS and the Cloud Files API, creating a potential post-compromise path for malware already running on a host.
Jul 12, 2026