Loading story…
A compromised HandBrake mirror server distributed a trojanized macOS installer that infected users who downloaded the application during a limited exposure window. The malicious HandBrake.app unpacked a hidden payload, launched it from a temporary path, and displayed a fake authentication prompt to steal the user’s password. Researchers identified the payload as Proton.B, a new variant of the OSX/Proton remote access trojan, which then installed itself persistently as activity_agent.app using ~/Library/LaunchAgents/fr.handbrake.activity_agent.plist and related files under ~/Library/RenderFiles/.
Once installed, Proton.B used the stolen credentials to gain elevated privileges with sudo, altered the tty_tickets setting, and decrypted embedded resources before checking connectivity and time sources. The malware harvested browser data, macOS keychains, GnuPG material, and 1Password vaults, compressed the stolen information into ZIP archives, and exfiltrated it to api.handbrake.biz. It also attempted to evade analysis by terminating tools such as Terminal and Wireshark and deleting system logs, while early defenses were limited because Apple’s initial XProtect coverage relied on a simple SHA-1 hash of the trojanized binary and the samples initially showed little or no antivirus detection.
Trace attribution and downstream blast radius.
5 events from the most recent confirmed update back to the earliest known activity.
A later technical analysis described Proton.B's behavior in depth, including social-engineering for the user's password, sudo abuse, persistence, theft of browser data, keychains, GnuPG material, and 1Password vaults, and exfiltration of stolen archives to api.handbrake.biz.
A compromised HandBrake mirror download server distributed a trojanized macOS disk image to users. HandBrake later identified the exposure window as running from 2017-05-02 14:30 UTC until 2017-05-06 11:00 UTC.
After the HandBrake incident, Apple released an XProtect rule named XProtect_OSX_Proton_B to detect the trojaned HandBrake binary. The analysis noted the protection relied on a single SHA-1 hash and could be bypassed by modifying the file.
Analysis of the trojanized HandBrake installer showed it unpacked a hidden payload, used a fake authentication prompt to steal credentials, and installed itself persistently as activity_agent.app via a LaunchAgent. The malware was assessed as a new OSX/Proton variant referred to as Proton.B.
HandBrake published a security alert stating that its mirror download server had been compromised and warning Mac users who downloaded during the affected window to verify hashes and check for Trojan infection.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 22 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers compromised trusted macOS software distribution channels to deliver **OSX/Proton**, first through a hacked HandBrake mirror and later through Eltima’s official website hosting trojanized **Elmedia Player** and **Folx** installers. In the Eltima incident, malicious packages were available for several hours on October 19 and were wrapped in a signed installer using an Apple Developer ID later revoked by Apple. In the HandBrake case, the trojaned application preserved normal functionality while covertly unpacking and launching a hidden payload, helping the malware evade immediate suspicion. The malware acted as a persistent macOS backdoor and information stealer, installing LaunchAgent persistence, using fake authorization prompts to obtain elevated privileges, and collecting sensitive data including browser credentials, **Keychain** contents, cryptocurrency wallets, **SSH** keys, **VPN** configurations, **GnuPG** material, and **1Password** data. Researchers also documented anti-debugging checks, encrypted configuration and tasking, and command-and-control infrastructure tied to domains such as `handbrake.biz` and `handbrake.cc`; Apple responded with certificate revocation and **XProtect** detection, while defenders advised affected users to reinstall macOS and rotate all potentially exposed secrets.
Aug 15, 2026
A malicious advertisement redirected users to a counterfeit Homebrew page that instructed victims to paste text into Terminal, leading to an **Atomic macOS Stealer (AMOS)** infection on macOS systems. The observed chain dropped files into `/tmp` and installed a persistent payload, with supporting artifacts including password-protected ZIP archives, temporary files, and a malware directory used to maintain access after execution. AMOS is a Golang-based macOS information stealer sold through criminal channels and marketed with ongoing updates and operator support. The malware is designed to harvest **Keychain data**, browser credentials, files, cryptocurrency wallet data, and system information, while also using fake password prompts to capture the macOS password before exfiltrating stolen data to command-and-control infrastructure and Telegram; researchers have previously linked the offering to a subscription model that included a victim management panel and other follow-on criminal services.
Jul 12, 2026
Threat actors are increasingly using weaponized `.dmg` files disguised as legitimate macOS software installers to deliver infostealer malware, with campaigns relying heavily on social engineering to convince users to bypass Apple Gatekeeper and other trust prompts. Researchers said the malware typically focuses on rapid collection and exfiltration rather than persistence, stealing browser credentials, cookies, authentication tokens, Apple Keychain data, macOS passwords, and cryptocurrency wallet information from infected systems. Multiple macOS stealer families have been tied to the tactic, including **Atomic macOS Stealer (AMOS)**, Poseidon, Odyssey, and MacSync. AMOS in particular has been marketed as malware-as-a-service and distributed through malvertising, SEO poisoning, fake download pages, social media ads, GitHub-hosted binaries, open directories, poisoned search results, and piracy forums while impersonating popular apps such as Notion, Trello, Arc, Slack, Todoist, and CleanMyMac X. Defenders were urged to monitor suspicious DMG mount activity in `/Volumes`, inspect hidden `.background` directories, use OCR on installer graphics, unmount suspicious disk images quickly, and restrict software installation to legitimate, Apple-verified sources outside unofficial or cracked-software channels.
Jun 29, 2026