Pirated Mac Applications Could Contain ThiefQuest Ransomware


If you have one or more illegal copies of Apple software on your Mac, be aware that there’s a new threat to be concerned about.

An info-stealing, data wiping malware strain known as ThiefQuest has been found embedded in torrents of illicit software written for macOS.

While ThiefQuest isn’t as commonly seen as some other macOS malware like FileCoder, Patcher or KeRanger, it’s still common enough to stay on the alert for. That’s especially if you use any of the popular torrent sites to grab copies of your favorite software.

The malware strain was first spotted in the wild by Dinesh Devadoss, a security research for K7 Lab. It was analyzed by Thomas Reed, the Director of Mac and Mobile Services for Malwarebytes, legendary researcher Patrick Wardle, and Bleeping Computer’s Lawrence Abrams.

Based on the findings of these researchers, here’s what we know about ThiefQuest:

  • It has some advanced anti-detection capabilities, including the ability to check to see if it’s running on a virtual machine, and if so, it will terminate to avoid detection.
  • It installs a keylogger and opens a reverse shell on the infected machine,
  • It has the ability to check for some of the more commonly used security tools and antimalware solutions, including Kaspersky, Norton, McAffee, Bitdefender, Bullguard, DrWeb, and Avast)

Armed with these capabilities, the attacker can maintain full control over an infected host” Patrick Wardle noted.

Curiously, ThiefQuest seems almost picky in terms of what files it encrypts. There doesn’t appear to be a readily definable pattern, and this can cause a variety of issues on infected systems.

In any event, once it finishes encrypting whatever files it has selected, it will generate a text file named “READ_ME_NOW.txt” that includes ransom instructions. Victims are currently being asked to pay a $50 ransom in Bitcoin within 72 hours of the message being generated, which is a quite modest sum by modern ransomware standards.

Wardle and the other researchers note, however, that it could increase at any time. Beware of ThiefQuest. Although not the most dangerous malware strain out there, it’s certainly a legitimate threat.

Used with permission from Article Aggregator



Don’t even think about calling a computer consultant before you read this!

If you are a small to medium business owner looking for computer support, then it’s critical that you read this business guide about IT services: This Business Advisory Guide Will Arm You With 18 Revealing Questions You Should Ask Any Computer Consultant Before Giving Them Access To Your Company’s Network.

Important! We hate spam as much (or more!) than you and promise to NEVER rent, share, or abuse your e-mail address and contact information in any way.

“Be Your Own Best Defense Against Cybercrime”

Sign Me Up For The Free Assessment

Book My Brief 30 Minute Initial Consultation