EvilQuest is a ransomware targeting macOS, first discovered in 2020. EvilQuest (also called ThiefQuest) is a macOS ransomware that combines file encryption with keylogging and cryptocurrency wallet theft. Distributed through pirated macOS software on torrent sites, it was notable for being one of the few ransomware families specifically targeting Mac users. Its encryption was later found to be reversible. CoreLock detects this threat using CoreLock detects EvilQuest through behavioral analysis of mass file encryption patterns, YARA rules matching its unique ransomware payload structure, process monitoring identifying keylogger and crypto-stealer modules, and entropy analysis flagging rapidly encrypted file sequences.
Also known as: ThiefQuest, OSX.EvilQuest
EvilQuest (also called ThiefQuest) is a macOS ransomware that combines file encryption with keylogging and cryptocurrency wallet theft. Distributed through pirated macOS software on torrent sites, it was notable for being one of the few ransomware families specifically targeting Mac users. Its encryption was later found to be reversible.
Trojanized pirated macOS applications on torrent sites
Fake installers for Little Snitch, Mixed In Key, and Ableton Live
Software cracks and keygens shared on file-sharing forums
Malicious PKG files bundled with seemingly legitimate tools
Files encrypted with a ransom note demanding Bitcoin payment
Recently installed pirated or cracked macOS software
System sluggishness and high CPU usage from encryption processes
Unknown processes keylogging or accessing cryptocurrency wallet files
EvilQuest's encryption is known to be reversible. Security researchers have released free decryption tools. Paying the ransom funds criminal operations and does not guarantee file recovery.
Restart your Mac and hold the Shift key to boot into Safe Mode, which prevents the malware's LaunchAgent from executing at startup.
Delete the pirated application that served as the infection vector. Remove the malware's persistence plist from ~/Library/LaunchAgents and its binary from ~/Library/mixednkey or similar hidden directories.
Use the free decryption tool released by SentinelOne to recover encrypted files. The tool exploits weaknesses in EvilQuest's encryption implementation.
Run a full CoreLock scan to ensure all components are removed, including the keylogger and crypto-stealer modules that operate independently of the ransomware component.
Never download pirated software — it is the primary distribution method for Mac malware
Maintain regular Time Machine backups to recover from any ransomware attack
Verify application code signatures before opening any installer
Use CoreLock's process monitoring to detect encryption behavior patterns in real time
Real-time Detection
CoreLock detects EvilQuest through behavioral analysis of mass file encryption patterns, YARA rules matching its unique ransomware payload structure, process monitoring identifying keylogger and crypto-stealer modules, and entropy analysis flagging rapidly encrypted file sequences.
Ransomware — KeRanger was the first fully functional ransomware targeting macOS, discovered i...
Stealer — Atomic Stealer (AMOS) is a sophisticated macOS information stealer sold as malwa...
Trojan — Lazarus Group is a North Korean state-sponsored APT that has increasingly target...
Yes. Security researchers at SentinelOne discovered weaknesses in EvilQuest's encryption and released a free decryption tool. Do not pay the ransom — the encryption is reversible without payment.
EvilQuest is no longer actively distributed, but trojanized pirated software containing it may still circulate on older torrent sites. Its techniques influenced later macOS threats that combine ransomware with information stealing.
No. EvilQuest is a triple-threat: it encrypts files for ransom, installs a keylogger to capture passwords, and steals cryptocurrency wallet files. Even if you decrypt your files, the keylogger component may have already captured sensitive data.
Download CoreLock to detect and remove EvilQuest and other macOS threats. AI-powered analysis, real-time monitoring, and one-click remediation.
Download CoreLock FreeAvailable for macOS and Windows