OSX/Proton.B; a brief analysis, 6 miles up

Objective-See's analysis of OSX/Proton.B, the malware planted in HandBrake downloads from a compromised mirror server in early May 2017, shows how the trojan works. The app unpacks an encrypted payload, and the payload exits if Little Snitch, Radio Silence or HandsOff is installed. That check likely explains why some users who ran the app were not infected, though the evidence is the author's own reports from a few users. Its decrypted commands cover password phishing, log wiping and theft of keychains and browser data. Apple has added an XProtect signature.