A Mac pest that keeps rebuilding itself has surfaced as the most interesting ransomware specimen in years. Objective-See published an analysis of Heartbreaker, which rewrites its own source code and recompiles itself between runs. The binary appeared on VirusTotal in May 2025 and still draws zero detections.
Heartbreaker is an ad hoc-signed ARM64 executable written in Rust. It walks Downloads, truncates each file, overwrites the contents with encrypted bytes and appends a .heartbreaker extension. A note demands 0.003 BTC. It also plants a LaunchAgent to catch files restored later.
Encryption uses AES-GCM with a fresh nonce per file, which looks sound until you notice one hard-coded passphrase is baked in and reused for every victim. Since each file stores its own nonce, recovery needs nothing from the operator. Objective-See released a decryptor that restores files without a payment, and the authentication tag doubles as a damage check.
The metamorphic trick earns the attention. Rust’s include_str macro staples the malware’s own main.rs and build.rs into the compiled binary, so the source ships inside the payload. After encryption, Heartbreaker pulls that source back out, generates fifteen junk functions, randomizes identifiers between marker comments and calls the Rust compiler. A successful build swaps the new binary in for itself. Every rebuild changes the hash while behavior stays fixed, and the scheme is brittle anyway, because the build depends on a GitHub dependency that is no longer online.
Heartbreaker tests a detection idea rather than extorting anyone. It touches only Downloads, ignores Apple’s privacy prompts and has a dead Decrypt button. Patrick Wardle used it to demonstrate RansomWhere, a free tool watching for untrusted processes that rapidly produce high-entropy files. Endpoint Security sees that pattern no matter how the binary is dressed.
