Patrick Wardle (Objective-See, Oct 18) analyzed Heartbreaker, an ad hoc-signed ARM64 Mach-O written in Rust. It was uploaded to VirusTotal in May 2025 and was still detected by zero engines when he wrote it up. It encrypts files under ~/Downloads with AES-256-GCM using one hard-coded key, renames them to *.heartbreaker, drops README.txt on the Desktop and asks for 0.003 BTC. Because the key is hard-coded, victims can recover their files without paying; Objective-See published a decryptor approach. The unusual part is that the malware carries its own main.rs/build.rs (via include_str!), randomizes it with the mimicore crate, installs Rust if it's missing, runs cargo build --release and replaces itself, so every new generation has a new hash. Wardle rates it unlikely to be a major threat: it only touches Downloads, its build dependency is gone, and it's very noisy.

Hunt for:

• Files ending in .heartbreaker, or a new ~/Desktop/README.txt containing "HEARTBREAKER".
• A LaunchAgent at ~/Library/LaunchAgents/com.network.startup.plist (its internal Label is com.myapp.startup) whose ProgramArguments points to an unsigned binary.
• An ad hoc-signed binary whose identifier starts heartbreaker-, or that contains the strings METAMORPHIC_MARKER_START or mimicore.
• A non-developer process starting rustup/cargo build --release and then overwriting its own executable. That's a strong signal on endpoints that don't normally have Rust.
• Behavioral detection: a quick burst of high-entropy rewrites in ~/Downloads by an untrusted process. This is what RansomWhere? caught, without needing a signature.

Hash-based blocklists won't keep up with this design. Key on paths, strings that survive rebuilds, and behavior.