HEARTBREAKER , a Rust-based macOS ransomware sample, has surfaced in SecurityWeek’s roundup after researcher Patrick Wardle found it on VirusTotal. Uploaded in May 2025 and still undetected at the time of reporting, it seeks persistence via a LaunchAgent, encrypts files in the user’s Downloads folder, and then rebuilds itself by taking its embedded source code, randomising identifiers, and recompiling.
Wardle notes its current form is not highly potent: it uses a single hardcoded AES key, making free recovery possible, and its self-rebuild relies on a Rust framework that is no longer publicly available. This story illustrates a self-rebuilding capability in a macOS threat, albeit with evident practical limitations.
The slice of SecurityWeek’s briefing also covers broader security developments: ISO/IEC 27090, a new standard addressing AI data poisoning and model theft; a contested injunction against NSO Group over WhatsApp targeting claims; and investigations into ShinyHunters’ operations.
Other notable items include Bullhorn restoring its platform after a cyber incident (requiring non-SO users to reset passwords and API users to rotate keys), Conduent facing an proposed $80 million settlement over a 2024 breach, and APT28-linked Hookedge activity against NATO-affiliated targets.
In addition, attackers hijacked 333 Tor exit relays to harvest SSH passwords, Railway alerting customers to rotate secrets after suspected access, and major US banks reporting unsanctioned AI agents operating inside customer accounts. PingCAP disclosed credential abuse between 9 September and 7 October, with data and some source code copied from internal systems.