EvilQuest, also called ThiefQuest, is 2020 macOS malware that came inside pirated apps, encrypted files like ransomware and also logged keystrokes and stole files. If files on your Mac were encrypted by it, don't pay: SentinelOne released a free decryptor, and you should then remove the pirated app and its launch items.
Last reviewed · 3 sources
Also known as: ThiefQuest, OSX.EvilQuest
EvilQuest, also named ThiefQuest, was found in 2020 in trojanized pirated Mac apps, such as an unsigned copy of the DJ app Mixed In Key (Objective-See). It encrypts files and leaves a ransom note, but MITRE ATT&CK notes the decryption key is never sent to the attacker, so it behaves more like a wiper; it also carries keylogging and file-stealing code and spreads to other files on the Mac like a virus. SentinelOne found its encryption reversible and released a free decryptor in July 2020.
Trojanized pirated Mac apps shared on torrent sites and Russian forums (MITRE ATT&CK)
An unsigned copy of the DJ app Mixed In Key (Objective-See)
Software cracks and keygens shared on file-sharing forums
Unsigned installer packages that macOS warns about before opening
Files that won't open, alongside a ransom note asking for Bitcoin
You recently installed pirated or cracked Mac software
Heavy CPU use while files are being encrypted
An installer that macOS warned was from an unidentified developer
SentinelOne found EvilQuest's encryption reversible and released a free decryptor. Paying funds the operation and, since the key is never sent to the attacker, wouldn't bring files back anyway.
Safe Mode stops most launch items from running. On an Apple silicon Mac, shut down, hold the power button until startup options appear, select your disk, then hold Shift and click Continue in Safe Mode. On an Intel Mac, hold Shift while it starts up.
Delete the pirated app and its installer, and remove plist files created at the same time from ~/Library/LaunchAgents and /Library/LaunchDaemons.
Use SentinelOne's free EvilQuest decryptor. It restores files only, so finish cleaning up the Mac as well.
EvilQuest has keylogging code, so change passwords you typed on this Mac while it was installed, from another device.
CoreLock's free scan checks startup items and the Downloads folder. It can't confirm that the keylogging and file-stealing parts are gone, so do the manual steps too.
Don't install pirated software: it's how EvilQuest spread
Keep regular Time Machine backups so a wiped or encrypted file can be restored
Take macOS's warning about an unsigned installer seriously
Get apps from the Mac App Store or the developer's own site
What it can and can't do
EvilQuest arrived in pirated installers, which CoreLock's free Downloads check compares against a built-in malware-hash list and 19 YARA rules, and its startup-items check covers the launch items it adds. CoreLock doesn't stop encryption, restore files or quarantine anything on its own, and it can't promise to catch every variant.
Ransomware — KeRanger was hidden in two installers of Transmission 2.90 that were posted on T...
Stealer — Atomic Stealer (AMOS) is a macOS information stealer that Cyble found advertised...
Trojan — Lazarus Group is a North Korean state-sponsored group attributed to the Reconnai...
Yes. SentinelOne reverse-engineered EvilQuest's file encryption, found it reversible, and released a free decryptor in July 2020. It decrypts files only; you still need to remove the malware.
The 2020 campaign spread through pirated software on torrent sites and Russian forums. Infected copies can linger in old torrents, so the advice hasn't changed: don't install pirated apps.
No. Besides encrypting files, it has keylogging and file-stealing code and can spread to other files on the Mac. MITRE ATT&CK describes it as a virus, data stealer and wiper that presents itself as ransomware.
Free, with no account: the scan checks your Downloads folder against a built-in malware-hash list and 19 YARA rules.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser