Loading story…
Attackers compromised trusted macOS software distribution channels to deliver OSX/Proton, first through a hacked HandBrake mirror and later through Eltima’s official website hosting trojanized Elmedia Player and Folx installers. In the Eltima incident, malicious packages were available for several hours on October 19 and were wrapped in a signed installer using an Apple Developer ID later revoked by Apple. In the HandBrake case, the trojaned application preserved normal functionality while covertly unpacking and launching a hidden payload, helping the malware evade immediate suspicion.
The malware acted as a persistent macOS backdoor and information stealer, installing LaunchAgent persistence, using fake authorization prompts to obtain elevated privileges, and collecting sensitive data including browser credentials, Keychain contents, cryptocurrency wallets, SSH keys, VPN configurations, GnuPG material, and 1Password data. Researchers also documented anti-debugging checks, encrypted configuration and tasking, and command-and-control infrastructure tied to domains such as handbrake.biz and handbrake.cc; Apple responded with certificate revocation and XProtect detection, while defenders advised affected users to reinstall macOS and rotate all potentially exposed secrets.
Trace attribution and downstream blast radius.
8 events from the most recent confirmed update back to the earliest known activity.
Eltima confirmed that its infrastructure had been cleaned up and was again serving legitimate applications. This restoration was confirmed at 3:10pm EDT.
Eltima acknowledged the issue and initiated remediation efforts. This acknowledgment occurred at 2:25pm EDT.
After confirming the trojanized package, ESET contacted Eltima about the compromise. This notification occurred at 10:35am EDT.
ESET discovered on October 19, 2017 that Eltima’s official website was distributing a trojanized Elmedia Player package containing OSX/Proton. The attacker had wrapped the legitimate app with malware and signed it using an Apple Developer ID associated with Clifton Grimm.
Eltima’s official website distributed trojanized versions of Elmedia Player and later Folx containing OSX/Proton in a supply-chain attack. The malicious downloads were available from about 08:00 to 15:15 EDT, and users who downloaded and executed them during that window were likely compromised.
The command-and-control domain eltima[.]in, used in the later Eltima supply-chain attack, was registered and configured to mimic the legitimate eltima.com domain. ESET associated it with IP address 5.196.42.123.
Apple revoked the Developer ID certificate used to sign the malicious Eltima application wrappers after coordination with ESET and Eltima. This cut off trust in the attacker-signed packages.
A hacked mirror server used for HandBrake distribution served a trojaned HandBrake.app to macOS users, delivering the OSX/Proton.B malware variant. The malware installed persistence as a LaunchAgent, used fake credential prompts, and targeted sensitive data including Keychain, browser data, 1Password, and GnuPG files.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 30 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A compromised HandBrake mirror server distributed a trojanized macOS installer that infected users who downloaded the application during a limited exposure window. The malicious `HandBrake.app` unpacked a hidden payload, launched it from a temporary path, and displayed a fake authentication prompt to steal the user’s password. Researchers identified the payload as **Proton.B**, a new variant of the OSX/Proton remote access trojan, which then installed itself persistently as `activity_agent.app` using `~/Library/LaunchAgents/fr.handbrake.activity_agent.plist` and related files under `~/Library/RenderFiles/`. Once installed, Proton.B used the stolen credentials to gain elevated privileges with `sudo`, altered the `tty_tickets` setting, and decrypted embedded resources before checking connectivity and time sources. The malware harvested browser data, macOS keychains, GnuPG material, and **1Password** vaults, compressed the stolen information into ZIP archives, and exfiltrated it to `api.handbrake.biz`. It also attempted to evade analysis by terminating tools such as Terminal and Wireshark and deleting system logs, while early defenses were limited because Apple’s initial XProtect coverage relied on a simple SHA-1 hash of the trojanized binary and the samples initially showed little or no antivirus detection.
Aug 15, 2026
Threat actors are increasingly using weaponized `.dmg` files disguised as legitimate macOS software installers to deliver infostealer malware, with campaigns relying heavily on social engineering to convince users to bypass Apple Gatekeeper and other trust prompts. Researchers said the malware typically focuses on rapid collection and exfiltration rather than persistence, stealing browser credentials, cookies, authentication tokens, Apple Keychain data, macOS passwords, and cryptocurrency wallet information from infected systems. Multiple macOS stealer families have been tied to the tactic, including **Atomic macOS Stealer (AMOS)**, Poseidon, Odyssey, and MacSync. AMOS in particular has been marketed as malware-as-a-service and distributed through malvertising, SEO poisoning, fake download pages, social media ads, GitHub-hosted binaries, open directories, poisoned search results, and piracy forums while impersonating popular apps such as Notion, Trello, Arc, Slack, Todoist, and CleanMyMac X. Defenders were urged to monitor suspicious DMG mount activity in `/Volumes`, inspect hidden `.background` directories, use OCR on installer graphics, unmount suspicious disk images quickly, and restrict software installation to legitimate, Apple-verified sources outside unofficial or cracked-software channels.
Jun 29, 2026
Researchers reported multiple campaigns distributing macOS infostealers tied to the **AMOS/AtomicStealer** ecosystem, a malware-as-a-service operation that steals credentials, browser data, cryptocurrency wallets, Apple Notes, files, and **Keychain** material from macOS Catalina and newer systems on Intel, M1, and M2 devices. Earlier reporting on related macOS stealers showed operators relying on social engineering, unsigned DMG files, and password prompts to collect sensitive data, package it into archives, and exfiltrate it to command-and-control servers, with some activity also summarized to Telegram channels. More recent campaigns used **malvertising** and fake software or troubleshooting pages to lure users into running Terminal commands that fetched an AMOS variant known as **"malext"**. Investigators said the malware used obfuscated shell commands, `osascript`, quarantine removal, anti-VM and sandbox checks, and in some cases installed persistence through a LaunchDaemon and helper scripts, while also trojanizing Ledger and Trezor applications and capturing administrator passwords. Reporting also linked AMOS delivery to fake **CleanMyMac** sites and AI-themed lures, indicating operators are rapidly rotating ad accounts and adapting infection vectors to broaden theft and remote access on macOS systems.
Jun 29, 2026