OSX/Proton.B; a brief analysis, 6 miles up
Comments on “OSX/Proton.B; a brief analysis, 6 miles up”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Objective-See's analysis of OSX/Proton.B, the malware planted in HandBrake downloads from a compromised mirror server in early May 2017, shows how the trojan works. The app unpacks an encrypted payload, and the payload exits if Little Snitch, Radio Silence or HandsOff is installed. That check likely explains why some users who ran the app were not infected, though the evidence is the author's own reports from a few users. Its decrypted commands cover password phishing, log wiping and theft of keychains and browser data. Apple has added an XProtect signature.
Why it ranked
No. 18 of 93 with a score of 0.64. The panel rated it highest on technical depth (0.94) and new information (0.93), lowest on audience breadth (0.49). The judges disagreed most on reader interest (spread 0.51), so the story is marked contested.
Every answer behind this is in the table under Score.
Score
0.64total under rubric v2.2Contestedjudges differ by 0.51 on reader interest
- Significance0.57
- Reader interest0.70
- Audience breadth0.49
- Practical relevance0.67
- Substantiated0.90
- Technical depth0.94
- New information0.93
- Counts against: Promotional0.05
- Counts against: Overclaim0.14
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.50 | 0.50 | 0.72 | 0.57 | 0.22 | +0.24 | +0.138 |
| Reader interest | 0.39 | 0.80 | 0.90 | 0.70 | 0.51 , above the contested threshold | +0.26 | +0.181 |
| Audience breadth | 0.44 | 0.60 | 0.42 | 0.49 | 0.18 | +0.13 | +0.063 |
| Practical relevance | 0.52 | 0.70 | 0.78 | 0.67 | 0.27 | +0.22 | +0.146 |
| Substantiated | 0.91 | 0.90 | 0.88 | 0.90 | 0.03 | +0.05 | +0.045 |
| Technical depth | 0.99 | 0.90 | 0.91 | 0.94 | 0.10 | +0.05 | +0.047 |
| New information | 0.97 | 0.85 | 0.98 | 0.93 | 0.13 | +0.05 | +0.047 |
| Promotional | 0.05 | 0.05 | 0.04 | 0.05 | 0.01 | −0.19 | −0.009 |
| Overclaim | 0.23 | 0.10 | 0.08 | 0.14 | 0.15 | −0.11 | −0.015 |
| Sum of contributions | +0.643 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.643 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-25/18/"><img src="https://rubric.hrih.si/badge/2026-10-25/18.svg" alt="Ranked #18 on Rubric, 25 Oct 2026" width="245" height="28"></a>Claim check
Claim check: 3 matches source · 5 no source given. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Matches sourceCausal conclusion
A mirror server of the open-source video transcoder HandBrake was hacked, and the HandBrake macOS application was trojaned with a new variant of OSX/Proton.
The cited source says the same thing.
The article says “a mirror server of the popular open-source video transcoder, HandBrake, was hacked. One goal of the hack was to infect macOS users by trojaning the legitimate HandBreak application with a…”
The source says “With access to HandBrake's mirror, they trojaned the legitimate application, meaning any user who downloaded the application would inadvertently infect themselves”
Source cited by the article: objective-see.com/blog/blog_0x1D.html
No source givenCausal conclusion
The trojaned HandBrake app checks whether the persistent component is already installed by running pgrep for 'activity_agent', and otherwise unzips a password-protected payload from HBPlayerHUDMainController.nib and launches it from /tmp.
The article gives no link or citation for it.
The article says “The pgrep -x activity_agent && echo Queue.hbqueue command will echo 'Queue.hbqueue' if and only if 'activity_agent' is found in the process list”
The source says No source to compare with.
No source givenCausal conclusion
OSX/Proton.B's string decoding routine appears similar or identical to the DWOI function in the trojaned HandBrake installer, suggesting the hackers may have had access to the Proton.B source code.
The article gives no link or citation for it.
The article says “the string decoding method (at address 000000010001E6F7) appears to be similar (identical?) to the DWOI function in the malware's installer”
The source says No source to compare with.
Matches sourceGeneralization
OSX/Proton.A was offered for sale.
The cited source says the same thing.
The article says “OSX/Proton.A was offered for sale (see: "Hackers Selling Undetectable Proton Malware for macOS in 40 BTC”
The source says “Hackers are selling a malware for Mac devices on a prominent dark web marketing claiming that it is undetectable”
Source cited by the article: hackread.com/hackers-selling-undetectable-proton-mac-malware
No source givenCausal conclusion
OSX/Proton.B exits immediately if it finds the Little Snitch, Radio Silence or HandsOff kernel extensions on disk.
The article gives no link or citation for it.
The article says “For each of these paths, it checks if they exist on disk, and if so, the malware immediately exits”
The source says No source to compare with.
No source givenCausal conclusion
Users who ran the infected HandBrake app but were not persistently infected had all been running Little Snitch, which explains why they were not infected.
The article gives no link or citation for it.
The article says “Ah! Could this be why various users, who had ran the infected Handbrake application were not infected? Why yes! Turns out all had been running Little Snitch”
The source says No source to compare with.
No source givenNumber
OSX/Proton.B has commands to kill analysis tools, wipe system logs, persist as a launch agent, and exfiltrate user data such as 1Password files, browser login data and keychains.
The article gives no link or citation for it.
The article says “collect and exfiltrate sensitive user data such as 1Password files, browser login data, keychains, etc”
The source says No source to compare with.
Matches sourceCausal conclusion
Apple pushed out an XProtect signature for OSX/Proton.B, so new infections should be thwarted.
The cited source says the same thing.
The article says “Apple has also pushed out an XProtect signature, meaning that all new infections should be thwarted”
The source says “Apple has now also pushed out an XProtect signature, meaning that all new infections should be twarted. Hooray”
Source cited by the article: objective-see.com/blog/blog_0x1D.html
Also covered by
Elsewhere
Elsewhere: HN —
Recorded for context only, checked 25 Oct 2026, 05:46 UTC. It played no part in the ranking.