← Saturday 24 Octobernote 9 of 12
CybersecuritySat 24 Oct 2026 · 9 of 12

Self‑Rebuilding Heartbreaker macOS Ransomware Remains Undetected

Verified · 7/7 supported1 cited · 1 min read

securityweek.com reports that Heartbreaker is a Rust‑based macOS ransomware sample that was uploaded to VirusTotal in May 2025 . securityweek.com reports that the malware remains undetected by every antivirus engine on VirusTotal as of the report . securityweek.com reports that it attempts to establish persistence via a LaunchAgent before encrypting files in the user’s Downloads folder . securityweek.com reports that Heartbreaker tries to change its hash by extracting its embedded source code, randomizing identifiers, adding junk functions, and recompiling itself, even attempting to install Rust if missing . securityweek.com reports that researcher Patrick Wardle believes the ransomware is unlikely to become a major threat because it uses a single hardcoded AES key that allows free file recovery .

Why it matters. securityweek.com notes that the hardcoded AES key enables victims to recover encrypted files without paying, reducing immediate impact for affected users .

Earlier on Cybersecurity

Fri 23 Oct 2026Corey Thuen’s “evil bit” hiring philosophy at Gravwellsecurityweek.com reports that Corey Thuen is the founder and CEO of Gravwell, a firm that develops data analytics and vulnerability detection using big data experts and hackers. securityweek.com reports that Thuen hires hackers based on an “evil bit,” an adversarial mindset that can identify ways to exploit products. securityweek.com reports that he believes the “evil bit” is largely innate and not easily taught. securityweek.com reports that Thuen previously worked for the US government evaluating systems in power substations, part of critical infrastructure. securityweek.com reports that he references the old‑school hacking ethos that all information should be free and questions who defines morality.Thu 22 Oct 2026Google adds server‑side Gemini analysis and dual‑level warnings to Chrome securitysecurityweek.com reports that Google announced new Chrome protections against scams and social engineering, including new site warnings, server‑side Gemini analysis, and detection of ClickFix commands. securityweek.com reports that the Gemini and ClickFix protections are part of Enhanced Protection, the Safe Browsing mode introduced in 2020, and that more than 1 billion Chrome users had turned it on last year. securityweek.com reports that Google claims Enhanced Protection makes users ten times safer than Standard Protection against phishing, social engineering, notification abuse, and other scams, based on average safety warnings per user group. securityweek.com reports that Chrome’s Safe Browsing site warnings now have two levels—a full‑page red “dangerous site” warning for high‑confidence malicious pages and a “suspicious site” warning for lower‑confidence verdicts. securityweek.com reports that Gemini‑powered scam detection has moved to Google’s servers, while the on‑device version launched last year was limited to Enhanced Protection users and focused on tech‑support scams.Wed 21 Oct 2026US Agencies Issue Ten Voluntary Practices for Rogue Super‑Intelligence Agent Incidentssecurityweek.com reports that NIST, CISA and NSA released ten voluntary practices for preparing for, detecting, responding to, recovering from, and reporting rogue AI (super intelligence) agent incidents. securityweek.com notes that the guidance, titled “Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation,” uses the term super intelligence (SI) rather than AI to align with executive order 14434. securityweek.com explains that the ten practices are organized into five stages: prepare, detect, respond, recover, and report. securityweek.com adds that the report includes definitions for AI agents, AI control incidents, and AI control near‑misses. securityweek.com says the preparation stage lists activities such as asset and risk inventories, defense‑in‑depth, least privilege, zero‑trust controls, credential management, and supply‑chain risk management.
Next · Climate techSenate bipartisan permitting bill aims to cut years from energy project timelines →