OSX.Proton is a macOS backdoor for stealing data and credentials that was sold on underground forums in 2017 and spread that May through a hacked HandBrake download server. If you downloaded HandBrake for Mac between May 2 and May 6, 2017, look for a process or app named activity_agent and remove it, then change your passwords.
Last reviewed · 4 sources
Also known as: Proton RAT, Proton.B, Calisto
MITRE ATT&CK describes Proton as a macOS backdoor focused on data theft and credential access; it was offered for sale on underground forums in early 2017. In May 2017 a HandBrake mirror download server was compromised and the Mac app was swapped for a trojanized copy carrying a new variant, OSX/Proton.B; HandBrake warned anyone who downloaded it between 14:30 UTC on May 2 and 11:00 UTC on May 6 (Objective-See). The trojanized app asked for your password, then installed activity_agent with a LaunchAgent so it ran at every login. Apple pushed out an XProtect signature, and XProtect 5368 (macOS 26.5, checked October 29, 2026) still has signatures named OSX.Proton.A and OSX.Proton.B.
A compromised HandBrake mirror server that served a trojanized Mac download in May 2017
Sold on underground forums for other criminals to use
A password prompt in the trojanized app that gave it administrator rights
HandBrake for Mac downloaded between May 2 and May 6, 2017
A process named activity_agent in Activity Monitor
An app named activity_agent.app in ~/Library/RenderFiles
A plist named fr.handbrake.activity_agent.plist in ~/Library/LaunchAgents
Turn off Wi-Fi and unplug Ethernet to cut off the backdoor's connection.
In Activity Monitor, select any process named activity_agent and click Force Quit.
Delete ~/Library/LaunchAgents/fr.handbrake.activity_agent.plist and the ~/Library/RenderFiles/activity_agent.app folder, then restart.
Delete the HandBrake copy you downloaded and get a current version from the official site, checking its published SHA-256 checksum.
Proton targets credentials and the Keychain, so change your Apple Account, email, banking and other important passwords from another device, and turn on two-factor authentication.
CoreLock's free scan checks startup items, where Proton's LaunchAgent lives. It can't promise to find everything manual removal missed.
Check a download's published checksum, even from an official site
Be suspicious of any app that asks for your password the first time it opens
Keep automatic security updates on: Apple added Proton signatures to XProtect after the HandBrake compromise
Use an app's built-in updater where it has one; HandBrake's updater wasn't affected
What it can and can't do
Proton keeps running through a LaunchAgent, which the startup-items check in CoreLock's free scan covers. It can't promise to catch every variant.
Stealer — Atomic Stealer (AMOS) is a macOS information stealer that Cyble found advertised...
Trojan — Jamf Threat Labs described RustBucket in April 2023 and suspects a North Korean ...
Backdoor — Bitdefender disclosed Backdoor.MAC.Eleanor in July 2016. EasyDoc Converter.app p...
For the HandBrake variant, HandBrake and Objective-See listed three signs: a process named activity_agent, an app named activity_agent.app in ~/Library/RenderFiles, and a plist named fr.handbrake.activity_agent.plist in ~/Library/LaunchAgents.
Only downloads from the compromised mirror between 14:30 UTC on May 2 and 11:00 UTC on May 6, 2017 were at risk; updates through HandBrake's built-in updater weren't. If yours falls in that window, check for activity_agent, remove it, and change your passwords.
Apple says the camera is engineered so that it can't activate without the green camera indicator light also turning on. CoreLock's menu bar panel also shows which app is using the camera or microphone; it doesn't record or block either.
The 2017 campaigns are long over, and XProtect still carries Proton signatures. The HandBrake case remains a good reason to check download checksums.
Free, with no account: the scan checks your Downloads folder against a built-in malware-hash list and 19 YARA rules.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser