Loading story…
SentinelOne published a technical walkthrough showing how analysts can reverse the macOS malware EvilQuest and defeat its anti-analysis behavior with radare2. The guide demonstrates how to prepare a malware sample in a controlled macOS virtual machine, attach the debugger with elevated privileges, inspect functions and cross-references, and rename imported library calls to clarify the sample’s execution flow.
The tutorial focuses on dynamically bypassing EvilQuest checks without patching the binary, including skipping function execution and altering register return values during debugging. SentinelOne highlights routines such as _is_virtual_mchn and user_info, and notes that one of the checks appears closer to sleep-based sandbox evasion than true virtual-machine detection. The malware, first seen in 2020 and initially described as ransomware, is characterized in the report as ineffective in the wild and possibly a proof of concept or early-stage project.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
The analyzed EvilQuest sample became publicly notable in July 2020 after initially appearing to be a rare example of macOS ransomware. The article notes it was later assessed as ineffective in the wild and possibly a proof of concept or early-stage project.
SentinelLabs analyzed the EvilQuest malware and created a decryptor for potential victims. The reference does not provide an explicit date for when this analysis and decryptor release occurred.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A reverse-engineering analysis found that an apparent wave of more than 40,000 daily macOS malware samples was not a broad new outbreak but a **VirusTotal sandbox feedback loop** caused by a self-mutating **EvilQuest/ThiefQuest** variant. The malware repeatedly opened its own file via `argv[0]`, located the Mach-O `__cstring` section, and rewrote obfuscated strings on disk after decrypting and re-encrypting them. As a result, each execution produced a slightly different binary with the same `__text` hash but altered string data, leading VirusTotal to classify and resubmit each mutated copy as a new sample. The activity was traced back to initial submissions from Germany, and the analyzed variant was identified as an actively developed build linked to the hardcoded C2 address `159.65.147.28`. The research concluded that the surge exposed a weakness in macOS sandbox handling for self-modifying binaries and risked wasting analysis capacity and storage. Early antivirus detection for the malware was low before improving as signatures were updated. Supporting that analysis, a public GitHub repository released shortly afterward provided a **Go-based EvilQuest/ThiefQuest string deobfuscation tool** designed to decrypt individual or bulk-obfuscated strings from samples, building on the reverse-engineering work and earlier community tooling to aid further malware analysis.
Aug 15, 2026
Researchers documented several malware campaigns that used fake software and trojanized packages to deliver credential theft and remote-access payloads. On Windows, a fake *Resident Evil 9* mod from GitHub triggered a `curl | cmd` chain that deployed hidden batch, JavaScript, portable Node.js, portable Python, and an in-memory Go payload with browser theft, wallet targeting, hVNC-style control, webcam-related code, and exfiltration via Wormhole/B2 and Gofile; a separate fake AI video player installer led through Python bytecode, shellcode, and protected .NET loaders to **PureRAT**, which persisted through the `Run` key and communicated over authenticated WebSockets with `agent.sm-veo.com`. Another Windows campaign, dubbed **Operation TURB00**, used a Go loader and decoy console program to launch **Vidar** in memory, steal browser and application data, and install persistence through `agt.dll` and the `CadenceOptimizer` service running under `svchost` as `LocalSystem`. On macOS, analysts reversed a fully undetected **Atomic macOS Stealer (AMOS)** sample distributed as a signed DMG, bypassed its anti-VM checks, and recovered an AppleScript payload that stole browser data, wallet files, Telegram Desktop data, documents, and system information before exfiltrating to `95.164.53.3/contact`. In the software supply chain, a malicious PyPI package, `nhmpy 2.4.7`, masqueraded as NumPy while using a `.pth` file and an obfuscated JavaScript payload executed through Bun to harvest developer, cloud, CI/CD, registry, SSH, wallet, messaging, VPN, and AI-assistant secrets; it then spread using stolen GitHub tokens and malicious GitHub Actions workflows. Separately, a public Windows local privilege escalation exploit named **REDSUN** showed how attackers could turn standard-user access into `NT AUTHORITY\SYSTEM` by abusing a TOCTOU flaw involving NTFS and the Cloud Files API, creating a potential post-compromise path for malware already running on a host.
Jul 12, 2026
A security researcher showed that the anti-reverse-engineering controls in an anonymized 64-bit iOS banking app dubbed **VIBA** could be bypassed despite extensive runtime self-protection. The app used obfuscation, encrypted strings, anti-jailbreak checks, anti-`Frida` logic, debugger detection, file-integrity validation, and large volumes of raw syscalls to resist analysis on modified devices. The researcher found several protections relied on weak patterns, including simple XOR string decryption, recognizable success and failure constants, and `ptrace` and `exit` syscalls that could be patched out, allowing checks for Frida files, port `27042`, injected dylibs, jailbreak artifacts, and `Info.plist` integrity to be defeated through static patching and runtime hooking. Separate malware analysis detailed a stealth-focused macOS backdoor known as **Tiny FUD** that masquerades as Apple-like processes, hides itself from Finder, and communicates with a command-and-control server at `69.197.175.10:9999`. The trojan collects host identifiers including UUID, username, hostname, and kernel version, executes remote commands, and captures screenshots every five minutes for exfiltration. Researchers said the sample also used self-signing with permissive entitlements, `DYLD`-related injection support, and cleanup routines to erase traces and terminate itself and child processes, and they published indicators including SHA-256 `d64e2688344c685c4156819156bdb15630d1168314b21c919eee5540b1beb54a`, related domains, and a YARA rule to aid detection.
Jul 12, 2026