Loading story…
Multiple macOS malware campaigns used BitTorrent and pirated software installers to deliver ransomware or ransomware-themed payloads, showing that Apple systems were repeatedly targeted through fake cracks and trojanized apps. KeRanger was distributed through an infected Transmission BitTorrent client installer, while Patcher (OSX/Filecoder.E) posed as cracks for software such as Microsoft Office for Mac and Adobe Premiere Pro. Patcher encrypted files in user folders and mounted external or network volumes by placing them into password-protected ZIP archives, deleted the originals, and dropped README!.txt ransom notes demanding 0.25 BTC via a hardcoded wallet and email address.
Later analysis of EvilQuest/ThiefQuest found that its ransomware behavior was largely a cover for more destructive activity. The malware was spread through trojanized pirated macOS applications, established persistence, opened a reverse shell, checked for security tools, and downloaded Python-based payloads to steal files from /Users, including documents, certificates, source code, databases, and cryptocurrency wallets. Researchers also found major flaws in some of these campaigns: Patcher had no practical way to return encryption keys to victims even if they paid, and EvilQuest used suspiciously static ransom infrastructure, reinforcing that pirated software channels remained a recurring infection vector and that victims faced both irreversible data loss and data theft.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
BleepingComputer reported that ThiefQuest was not just ransomware but also a file stealer and wiper in disguise. The report described reverse-shell behavior, anti-analysis checks, and Python payloads used to exfiltrate sensitive files from infected Macs.
Objective-See published analysis of OSX.EvilQuest, documenting the macOS malware family. This marked public technical reporting on the threat under the EvilQuest name.
In February 2017, ESET analyzed a macOS ransomware family it detected as OSX/Filecoder.E, also calling itself "Patcher." The malware was distributed on BitTorrent sites as fake cracks for software including Microsoft Office for Mac and Adobe Premiere Pro.
A malicious recompiled Transmission 2.92 installer hosted on Transmission’s official website distributed OSX/Keydnap, an OS X backdoor that steals keychain contents and establishes persistence. Downloads obtained between August 28 and August 29, 2016 were affected, and Transmission removed the file within minutes after ESET notified the team.
Palo Alto Networks reported a new OS X ransomware family, KeRanger, distributed via an infected installer for the Transmission BitTorrent client. The reference identifies this as a distinct earlier macOS ransomware event preceding later families.
ThiefQuest was first spotted by K7 Lab researcher Dinesh Devadoss. Subsequent analysis tied the malware to trojanized installers of pirated macOS applications distributed on torrent sites.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourceobjective-see.com
Open sourcewelivesecurity.com
Open sourcewelivesecurity.com
Open sourceresearchcenter.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are increasingly using weaponized `.dmg` files disguised as legitimate macOS software installers to deliver infostealer malware, with campaigns relying heavily on social engineering to convince users to bypass Apple Gatekeeper and other trust prompts. Researchers said the malware typically focuses on rapid collection and exfiltration rather than persistence, stealing browser credentials, cookies, authentication tokens, Apple Keychain data, macOS passwords, and cryptocurrency wallet information from infected systems. Multiple macOS stealer families have been tied to the tactic, including **Atomic macOS Stealer (AMOS)**, Poseidon, Odyssey, and MacSync. AMOS in particular has been marketed as malware-as-a-service and distributed through malvertising, SEO poisoning, fake download pages, social media ads, GitHub-hosted binaries, open directories, poisoned search results, and piracy forums while impersonating popular apps such as Notion, Trello, Arc, Slack, Todoist, and CleanMyMac X. Defenders were urged to monitor suspicious DMG mount activity in `/Volumes`, inspect hidden `.background` directories, use OCR on installer graphics, unmount suspicious disk images quickly, and restrict software installation to legitimate, Apple-verified sources outside unofficial or cracked-software channels.
Jun 29, 2026
Microsoft reported that **information-stealing malware activity is expanding from Windows to macOS**, driven by campaigns observed since late 2025 that rely on social engineering and cross-platform tooling. The activity includes **ClickFix-style prompts** and **malicious DMG installers** that deliver macOS-focused infostealer families such as **Atomic macOS Stealer (AMOS)**, **MacSync**, and **DigitStealer**, with operators leveraging **fileless execution**, **native macOS utilities**, and **AppleScript automation** to evade defenses and automate collection. Initial access commonly starts with **malicious search ads (e.g., Google Ads)** that redirect users to fake sites impersonating legitimate tools and then trick victims into running “fix” steps or installing trojanized software. The malware is assessed to target high-value data including browser credentials and session cookies, **iCloud Keychain** contents, crypto wallet data, and **developer secrets**; Microsoft also highlighted growing use of **Python-based stealers** distributed via phishing for rapid adaptation across heterogeneous environments, citing **PXA Stealer** (linked to Vietnamese-speaking actors) as an example used in late-2025 campaigns with persistence mechanisms such as registry `Run` keys or scheduled tasks and **Telegram** used for command-and-control.
Jun 29, 2026
Microsoft reported that infostealer operators have broadened beyond traditional Windows-focused activity to target **macOS** and mixed-platform environments through social engineering, malicious installers, and abuse of trusted services. Since late 2025, researchers observed campaigns delivering **DigitStealer**, **MacSync**, and **Atomic macOS Stealer (AMOS)** via fake software downloads, malicious `.dmg` files, and **ClickFix**-style prompts that trick users into running Terminal commands, leading to theft of browser credentials, cryptocurrency wallet data, Keychain contents, and developer secrets. The company also linked multiple cross-platform and Python-based operations to the trend, including **PXA Stealer**, attributed to Vietnamese-speaking threat actors targeting government and education organizations through phishing, persistence mechanisms, and Telegram-based exfiltration. Separate campaigns used **WhatsApp** to spread **Eternidade Stealer** with worm-like propagation and pushed a fake **Crystal PDF** installer through malvertising and SEO poisoning to capture browser sessions and credentials. Microsoft said the activity increasingly relies on fileless execution, native utilities, obfuscation, **LOLBINs**, and trusted platforms to evade detection, and published Defender XDR detections, hunting queries, indicators of compromise, and mitigation guidance.
Jun 30, 2026