---
title: Hunt: Heartbreaker macOS ransomware (Rust, rebuilds itself with cargo; .heartbreaker files, com.network.startup.plist LaunchAgent) | ctxsec
url: https://ctxsec.com/items/hunt-heartbreaker-macos-ransomware
description: ""
status: "confirmed (Objective-See analysis); low real-world threat"
published: 2026-10-18
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-heartbreaker-macos-ransomware.md)

confirmed (Objective-See analysis); low real-world threat

2026-10-18

### Hunt: Heartbreaker macOS ransomware (Rust, rebuilds itself with cargo; .heartbreaker files, com.network.startup.plist LaunchAgent)

Patrick Wardle (Objective-See, Oct 18) analyzed Heartbreaker, an ad hoc-signed ARM64 Mach-O written in Rust. It was uploaded to VirusTotal in May 2025 and was still detected by zero engines when he wrote it up. It encrypts files under ~/Downloads with AES-256-GCM using one hard-coded key, renames them to `*.heartbreaker`, drops `README.txt` on the Desktop and asks for 0.003 BTC. Because the key is hard-coded, victims can recover their files without paying; Objective-See published a decryptor approach. The unusual part is that the malware carries its own `main.rs`/`build.rs` (via `include_str!`), randomizes it with the `mimicore` crate, installs Rust if it's missing, runs `cargo build --release` and replaces itself, so every new generation has a new hash. Wardle rates it unlikely to be a major threat: it only touches Downloads, its build dependency is gone, and it's very noisy.

**Hunt for:**

- Files ending in `.heartbreaker`, or a new `~/Desktop/README.txt` containing "HEARTBREAKER".
- A LaunchAgent at `~/Library/LaunchAgents/com.network.startup.plist` (its internal Label is `com.myapp.startup`) whose ProgramArguments points to an unsigned binary.
- An ad hoc-signed binary whose identifier starts `heartbreaker-`, or that contains the strings `METAMORPHIC_MARKER_START` or `mimicore`.
- A non-developer process starting `rustup`/`cargo build --release` and then overwriting its own executable. That's a strong signal on endpoints that don't normally have Rust.
- Behavioral detection: a quick burst of high-entropy rewrites in ~/Downloads by an untrusted process. This is what RansomWhere? caught, without needing a signature.

Hash-based blocklists won't keep up with this design. Key on paths, strings that survive rebuilds, and behavior.

Sources: [Objective-See: Heartbreaker (Oct 18)](https://objective-see.org/blog/blog_0x8A.html) · [DFIR Radar summary (X)](https://x.com/DFIR_Radar/status/2111880451757310095)