Mac users often hear that “viruses don’t affect Macs”. Heartbreaker, a ransomware sample analyzed by researcher Patrick Wardle, shows that line is out of date, but also that the current danger from this sample is small.
A program that rewrites itself
Heartbreaker is written in Rust and sets itself up with a LaunchAgent, the macOS mechanism for running programs automatically. Then it encrypts the files in the Downloads folder.
What stands out is how it tries to escape antivirus. To change its own digital fingerprint, the hash, it uses its embedded source code, swaps identifiers, adds junk functions and recompiles itself. If the computer does not have Rust installed, it tries to install it. The sample was uploaded to VirusTotal in May 2025 and, when Wardle wrote, was still undetected by every antivirus engine on the service.
Why it is not cause for panic
Wardles own assessment is that, as it stands, Heartbreaker is unlikely to be a major threat. It uses a single hardcoded AES key, which makes it possible to recover files for free. And the rebuild process depends on a framework that, according to Wardle, is no longer publicly available.
The analysis matters for what it foreshadows: malware that recompiles itself makes lists of known signatures useless, and defense comes to depend on what a program does.
How to protect yourself
- Back up with Time Machine or to the cloud, keeping a copy disconnected from your computer.
- Install software only from the App Store or the maker’s official site. Pirated and doubtful installers are a common way in.
- Check what runs when the Mac starts in System Settings, under General and Login Items, and remove what you do not recognize.
- Keep macOS updated and leave Gatekeeper on.
- Do not rely on antivirus alone. Care with attachments and downloads remains the main protection.
