Loading story…
A trojanized DMG distributing a pirated copy of the legitimate macOS text and hex editor UltraEdit was modified to load an unsigned third-party library, libConfigurer64.dylib. The library operates as a dropper, downloading and executing concealed payloads including a Khepri backdoor placed at /private/tmp/.test.
A second component at /Users/Shared/.fseventsd provides downloader and persistence functionality by installing a masqueraded macOS launch agent and retrieving an additional hidden payload into a temporary directory. Defenders should investigate unsigned dylib loads by trusted applications, network or execution activity from hidden binaries, suspicious launch-agent creation, and hidden Mach-O files in atypical directories.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Malwrhunterteam posted about a pirated macOS application with malicious capabilities. Subsequent analysis linked the activity to a trojanized version of the UltraEdit editor.
Patrick Wardle reported that the malicious application deployed second- and third-stage payloads, while JAMF Threat Labs identified and analyzed additional related samples.
A pirated UltraEdit DMG was altered to load the unsigned libConfigurer64.dylib dropper, which downloaded hidden payloads including a Khepri backdoor at /private/tmp/.test. A second component at /Users/Shared/.fseventsd established launch-agent persistence and downloaded another hidden payload into /tmp/.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers compromised trusted macOS software distribution channels to deliver **OSX/Proton**, first through a hacked HandBrake mirror and later through Eltima’s official website hosting trojanized **Elmedia Player** and **Folx** installers. In the Eltima incident, malicious packages were available for several hours on October 19 and were wrapped in a signed installer using an Apple Developer ID later revoked by Apple. In the HandBrake case, the trojaned application preserved normal functionality while covertly unpacking and launching a hidden payload, helping the malware evade immediate suspicion. The malware acted as a persistent macOS backdoor and information stealer, installing LaunchAgent persistence, using fake authorization prompts to obtain elevated privileges, and collecting sensitive data including browser credentials, **Keychain** contents, cryptocurrency wallets, **SSH** keys, **VPN** configurations, **GnuPG** material, and **1Password** data. Researchers also documented anti-debugging checks, encrypted configuration and tasking, and command-and-control infrastructure tied to domains such as `handbrake.biz` and `handbrake.cc`; Apple responded with certificate revocation and **XProtect** detection, while defenders advised affected users to reinstall macOS and rotate all potentially exposed secrets.
Aug 15, 2026
Multiple macOS malware campaigns used BitTorrent and pirated software installers to deliver ransomware or ransomware-themed payloads, showing that Apple systems were repeatedly targeted through fake cracks and trojanized apps. **KeRanger** was distributed through an infected Transmission BitTorrent client installer, while **Patcher** (`OSX/Filecoder.E`) posed as cracks for software such as Microsoft Office for Mac and Adobe Premiere Pro. Patcher encrypted files in user folders and mounted external or network volumes by placing them into password-protected ZIP archives, deleted the originals, and dropped `README!.txt` ransom notes demanding **0.25 BTC** via a hardcoded wallet and email address. Later analysis of **EvilQuest/ThiefQuest** found that its ransomware behavior was largely a cover for more destructive activity. The malware was spread through trojanized pirated macOS applications, established persistence, opened a reverse shell, checked for security tools, and downloaded Python-based payloads to steal files from `/Users`, including documents, certificates, source code, databases, and cryptocurrency wallets. Researchers also found major flaws in some of these campaigns: Patcher had no practical way to return encryption keys to victims even if they paid, and EvilQuest used suspiciously static ransom infrastructure, reinforcing that pirated software channels remained a recurring infection vector and that victims faced both irreversible data loss and data theft.
Aug 14, 2026
Threat actors are increasingly using weaponized `.dmg` files disguised as legitimate macOS software installers to deliver infostealer malware, with campaigns relying heavily on social engineering to convince users to bypass Apple Gatekeeper and other trust prompts. Researchers said the malware typically focuses on rapid collection and exfiltration rather than persistence, stealing browser credentials, cookies, authentication tokens, Apple Keychain data, macOS passwords, and cryptocurrency wallet information from infected systems. Multiple macOS stealer families have been tied to the tactic, including **Atomic macOS Stealer (AMOS)**, Poseidon, Odyssey, and MacSync. AMOS in particular has been marketed as malware-as-a-service and distributed through malvertising, SEO poisoning, fake download pages, social media ads, GitHub-hosted binaries, open directories, poisoned search results, and piracy forums while impersonating popular apps such as Notion, Trello, Arc, Slack, Todoist, and CleanMyMac X. Defenders were urged to monitor suspicious DMG mount activity in `/Volumes`, inspect hidden `.background` directories, use OCR on installer graphics, unmount suspicious disk images quickly, and restrict software installation to legitimate, Apple-verified sources outside unofficial or cracked-software channels.
Jun 29, 2026