KeRanger was the first fully working Mac ransomware, found by Palo Alto Networks in March 2016 inside a tampered copy of the Transmission BitTorrent app, version 2.90. It is no longer spreading; if you still have Transmission 2.90, update to a current version and check for a process or file named kernel_service.
Last reviewed · 2 sources
Also known as: OSX.KeRanger, KeyRanger
KeRanger was hidden in two installers of Transmission 2.90 that were posted on Transmission's own website on March 4, 2016. They were signed with a valid Mac app development certificate, so Gatekeeper let them open. KeRanger waited three days, then encrypted documents and asked for one bitcoin (about $400 at the time). Apple revoked the certificate and updated XProtect, and the Transmission Project removed the installers; XProtect 5368 (macOS 26.5, checked October 29, 2026) still carries a signature named OSX.KeRanger.A.
Two tampered installers of Transmission 2.90 posted on Transmission's official site on March 4, 2016
Signed with a valid Mac app development certificate, so Gatekeeper didn't block them
People who downloaded Transmission during that window
Transmission 2.90 downloaded in early March 2016
A file named README_FOR_DECRYPT.txt next to files that won't open
Hidden files ~/Library/.kernel_pid, ~/Library/.kernel_time and ~/Library/.kernel_complete
A process or file named kernel_service in ~/Library
Transmission 2.92 and later replaced the infected build. Update to a current version or uninstall Transmission.
In Activity Monitor, force-quit any process named kernel_service, then delete ~/Library/kernel_service and the hidden files ~/Library/.kernel_pid, ~/Library/.kernel_time and ~/Library/.kernel_complete.
If files were encrypted, restore them from a Time Machine backup made before the infection. Palo Alto Networks found KeRanger also appeared to try to encrypt Time Machine backups, so check the backup before relying on it.
Keep regular backups with Time Machine or another tool, including one that isn't always connected
Verify download checksums when a developer publishes them
Keep software updated so a replaced build is fixed quickly
Remember that a valid signature shows who signed an app, not that it's safe
What it can and can't do
KeRanger shipped with a valid developer signature, the kind of file only a known hash or malware rule would flag. CoreLock's free Downloads check compares files against a built-in malware-hash list and 19 YARA rules and shows a match as worth a look; it doesn't stop encryption or restore files, and it can't promise to catch every variant.
Ransomware — EvilQuest, also named ThiefQuest, was found in 2020 in trojanized pirated Mac ap...
Trojan — Trend Micro described XCSSET in August 2020: it inserts code into local Xcode pr...
Trojan — Silver Sparrow is an activity cluster Red Canary reported in February 2021. Its ...
System Settings › Privacy & Security › Accessibility (on macOS 27, some developers' guides call this pane Device Control and Data Access)
System Settings › Privacy & Security › Input Monitoring
System Settings › Privacy & Security › Location Services
Palo Alto Networks believes it was the first fully functional ransomware seen on OS X. An earlier one, FileCoder, was incomplete when it was discovered.
Two Transmission 2.90 installers on the project's official site were replaced with versions carrying KeRanger. Palo Alto Networks said Transmission's website may have been compromised but couldn't confirm how. The installers were signed with a valid Mac app development certificate, which let them pass Gatekeeper.
No longer: the certificate was revoked, the installers were removed, and XProtect still has a signature for it. The lesson remains: a year later, a HandBrake download server was compromised the same way to spread OSX.Proton.
Free, with no account: the scan checks your Downloads folder against a built-in malware-hash list and 19 YARA rules.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser