Library/LaunchAgents/Īpple and Eltima have disabled the developer ID that was used to sign the Proton-infected software bundle, and Eltima is working with Apple to figure out what happened.Īnyone who was impacted by the malware will need to reinstall macOS to get rid of it. The following files will be found on an infected system: Eastern Time may be affected by the malware. The compromised software was discovered on October 19, and customers who downloaded software from Eltima on that date before 3:15 p.m.

In an email to ZDNet, an Eltima spokesperson said that the malware was distributed with downloads as a result of their servers being 'hacked' after attackers 'used a security breach in the tiny_mce JavaScript library on our server.'

The Proton backdoor lets attackers access browser information, keylogs, usernames, passwords, macOS keychain data, and more. Mac owners who have recently downloaded Elmedia Player or Folx from Eltima Software may have unwittingly installed malware on their machines, reports ZDNet.ĭownloads of Folx and Elmedia player were infected with Proton, a Remote Access Trojan, after Eltima's servers were hacked.

Folx torrent review