Threat feed

Heartbreaker macOS ransomware

Heartbreaker: metamorphic macOS ransomware with attempted self-recompilation and demonstrated entropy-based detection

Posted · Updated · Spectrum Delta Research Team

Summary

Patrick Wardle's Objective-See analysis (Oct 18, A/3) documents Heartbreaker, a previously unknown macOS ransomware sample uploaded to VirusTotal in May 2025 with zero antivirus-engine detections in the scan at publication. It is an ad hoc-signed ARM64 Mach-O that attempts LaunchAgent persistence, recursively encrypts files in the user's ~/Downloads folder in place with AES-256-GCM using a hardcoded key (renaming them .heartbreaker, demanding 0.003 BTC), and then attempts to rebuild itself from embedded Rust source to change its hash — though Wardle assesses it as unlikely to be a major threat in its current form (the hardcoded key makes free recovery possible, and the rebuild depends on a build framework that is no longer publicly available, so successful rebuilds are not established).

Breakdown

Adversary

No attribution — a single sample with no observed campaign

Procedures (3)

  1. In-place Downloads-folder encryption by untrusted process

    Data encrypted for impact: in-place Downloads-folder encryption

    • T1486Data Encrypted for Impact

    Logs

    • macOS Endpoint Security — file events · Modified-file close events; plist creation (entropy needs content analysis)

    Detectors

    No known detector

Click to expand remaining (2) procedures

  1. LaunchAgent persistence for re-execution

    LaunchAgent persistence for re-execution at login

    • T1543.001Create or Modify System Process: Launch Agent

    Logs

    • macOS Endpoint Security — file events · Modified-file close events; plist creation (entropy needs content analysis)

    Detectors

    No known detector

  2. Metamorphic self-rebuild from embedded Rust source

    Compile after delivery: metamorphic self-rebuild from embedded source

    • T1027.004Obfuscated Files or Information: Compile After Delivery

    Logs

    • macOS Endpoint Security — process events · cargo/rustc process execution; file events corroborate self-replacement
    • macOS Endpoint Security — file events · Modified-file close events; plist creation (entropy needs content analysis)

    Detectors

    No known detector

Indicators of compromise

Hunt only

(Wardle analysis (https://objective-see.org/blog/blog_0x8A.html), A/3) — code-signing identifier heartbreaker-e2c97a640967e3f6 (ad hoc, linker-signed ARM64 Mach-O, no sample hash published); encrypted-file extension .heartbreaker (layout: 12-byte nonce || ciphertext || 16-byte GCM tag); ransom note README.txt on Desktop; demand 0.003 BTC; LaunchAgent ~/Library/LaunchAgents/com.network.startup.plist with Label com.myapp.startup, RunAtLoad true; hardcoded AES-256 key g_w`:D2Xq6Yxez-5{#3mfd=VcB.Qhsub; metamorphic markers METAMORPHIC_MARKER_START/END; junk-function count 15 per rebuild; dependency mimicore (github.com/saaaarwar/mimicore, no longer public; close public relative metacore); temp self-replacement via .tmp extension. Assessed 2026-10-24, hunt-only — single-sample indicators; the durable hunt value is the behavioral chain, and the hardcoded key means any confirmed infection is freely recoverable.

Detailed

Executable: heartbreaker, ARM64 (Apple silicon) Mach-O thin, ad hoc + linker-signed (CodeDirectory flags 0x20002), code-signing identifier heartbreaker-e2c97a640967e3f6 — no sample hash published in the primary (the sample is available in Objective-See's public macOS malware collection, password infect3d). Persistence: ~/Library/LaunchAgents/com.network.startup.plist, Label com.myapp.startup, RunAtLoad true. Encryption: .heartbreaker extension; file layout 12-byte nonce || ciphertext || 16-byte GCM tag; hardcoded AES-256 key g_w`:D2Xq6Yxez-5{#3mfd=VcB.Qhsub; ransom note README.txt on Desktop; demand 0.003 BTC. Rebuild: markers METAMORPHIC_MARKER_START/END; r_* identifier prefix (e.g. r_icEjsT1YtgAvu, r_akBqed, r_rDX7yjI3, r_TzUgnNR02NxZOF); 15 junk functions per rebuild; cargo build --release; .tmp self-replacement; dependencies aes-gcm 0.10.3 and mimicore (github.com/saaaarwar/mimicore, unavailable; public relative metacore). All from the primary (Wardle analysis (https://objective-see.org/blog/blog_0x8A.html), A/3), assessed 2026-10-24, hunt-only.

Sources

Grades are source reliability (A–F) and information credibility (1–6).

Questions, detections or sightings of Heartbreaker macOS ransomware? Bring them to the community.

Discuss in the Tradecraft Slack