HEARTBREAKER: METAMORPHIC RANSOMWARE COMES FOR MACOS

Summary from the TLDR InfoSec newsletter

Heartbreaker, a previously undetected Rust ransomware for Apple Silicon Macs, encrypts files in ~/Downloads with AES-256-GCM, persists through a LaunchAgent, and then rebuilds itself by mutating its own embedded source code and recompiling with Cargo to change its hash each run. Patrick Wardle found the rebuild fragile and noisy because it may install Rust on the fly, depends on a now-deleted GitHub framework, and uses a single hard-coded key that lets victims decrypt every file for free. His open-source RansomWhere? tool still caught it by flagging an untrusted process that rapidly writes high-entropy files, which shows why behavior-based detection holds up against mutating binaries better than hash-based signatures.