Recommended Free Tools
Yes. In February 2023, Jamf Threat Labs reported a modified pirated copy of Apple Final Cut Pro that installed XMRig, a cryptocurrency miner, on macOS. The analyzed samples used hidden files, I2P communications and process-name camouflage; some also stopped mining when Activity Monitor was open. These are findings about malware samples examined in 2023, not a guarantee about every pirated app or current security product.
What Jamf found in pirated Final Cut Pro
Jamf Threat Labs said it first encountered XMRig running under the guise of Apple’s Final Cut Pro. Researchers found an unauthorized modification in the application and matched its executable hash to a pirated Final Cut Pro torrent. They examined dozens of DMG uploads associated with the uploader, dating from 2019 onward, and reported that virtually every one they analyzed carried a cryptocurrency-mining payload. That describes the examined uploads only; it is not a prevalence estimate for pirated Mac software or Mac users.
The payload was XMRig, used to mine cryptocurrency for an attacker. Jamf’s report describes cryptojacking, not cryptocurrency-wallet theft. In one third-generation sample, Jamf measured the modified executable at 11.9 MB, compared with 3.7 MB for a genuine copy; the report attributed the difference to encoded payloads and shell commands. Those figures apply to that sample comparison, not to Final Cut Pro generally.
How the malware delivered and hid the miner
In the third-generation sample Jamf described, opening the modified app triggered shell commands embedded in its executable. Encoded data was unpacked into hidden files under /private/tmp. One component handled encrypted I2P traffic, which the malware used to contact its server and obtain XMRig. The app then launched a working copy of Final Cut Pro for the user.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
To blend into process listings, the malicious processes adopted names resembling mdworker_shared and mdworker_local, legitimate Spotlight-related names. Jamf also observed a loop that checked whether Activity Monitor was open and stopped malicious processes while it was. Mining could resume after Activity Monitor closed, so seeing no obvious process activity while it is open does not establish that a Mac is clean.
Why the malware’s persistence changed between generations
Jamf described several generations with different ways of surviving or avoiding detection:
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Early samples used elevated privileges and a Launch Daemon.
- Later first-generation samples used a user Launch Agent.
- Second-generation samples Jamf observed on Pirate Bay in April 2021 showed no traditional Launch Daemon or Launch Agent persistence and appeared to depend on the user launching the trojanized app.
- The more recent samples in Jamf’s analysis also relied on the user opening the app, and included the Activity Monitor check that stopped malicious processes while the utility was open.
Jamf’s 2024 Security 360: Annual Trends Report later characterized WTFMiner as cryptojacking malware spread through pirated macOS apps and described three generations of increasing stealth. That summary is evidence of the family’s characterization, not a fresh status assessment of the specific Final Cut Pro samples from 2023.
What Apple and security vendors said in 2023
Jamf’s February 2023 analysis said the sample was initially undetected by security vendors on VirusTotal, with a handful detecting it by January 2023. Jamf reported that Apple had updated XProtect signatures as of version 2166 and said Jamf Protect Threat Prevention blocked all known versions of the family at the time. The latter was Jamf’s own product claim, not an independently measured comparative test.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Macworld reported on February 23, 2023, that Apple said “the malware does not bypass Gatekeeper protections” and that macOS XProtect had been updated for the specific variants in Jamf’s research. These are dated statements about the variants discussed then; they do not establish present-day protection for every sample, macOS release or security product.
Jamf also discussed stricter signing checks in macOS Ventura. Those checks could prevent a modified Final Cut Pro app from launching, but did not necessarily prevent the miner from running beforehand. The outcome depended on the sample, app and launch behavior examined, so Ventura should not be treated as a blanket fix.
Rank #4
- The Encrypted Drive includes both USB-C Adapter. Ready for any USB-C or USB-A ports on your computer, laptop, phone, or other systems with USB support. Full USB 3.2 Speeds up to 5MBs. TAA Compliant, CJIS, HIPAA, CMMC, GDPR Compliant.
- The Secure Stick (Encrypted USB) does not require any software or drivers to validate and unlock the drive. Users can use face ID, fingerprint, or remember the password to unlock with the Free App on their smartphone. When using the Keypad, the built-in battery allows unlocking the drive before insertion.
- USB 3.2/3.1./3.0/2.0 is compatible with all systems and Operating systems. The USB Flash Drive comes formatted FAT32, but you can easily reformat it for Win, Mac, or Linux.
- Protect your files on with the Antivirus Software included on the drive. AV runs from the drive and scans all files written to it. This is a subscription service and the first year is included. Go online to activate the license after purchase.
- Military Grade, XTS-AES 256-bit Hardware Encryption made with aircraft grade and crush-proof aluminum sleeve keeps the data and the wireless flash drive safe. Rated IP68 to protect the drive from water or dust when the sleeve is on.
What to do if you downloaded or ran a suspect copy
- Do not open it. Avoid pirated application downloads and get Final Cut Pro through Apple’s authorized distribution channels.
- Keep macOS protections current. Install macOS updates and do not follow an untrusted installer or README that tells you to disable Gatekeeper.
- If you ran the app, seek device-specific help. Stop using the suspect copy and contact a trusted IT or security professional. The reports do not establish a universal cleanup procedure, so a single scan or deleting one file cannot be promised as sufficient.
- Treat unusual CPU use or unfamiliar processes as clues, not proof. Jamf’s sample could stop mining when Activity Monitor was open; an apparently quiet process list is not a reliable all-clear.
When assessing any security tool, check whether it explicitly supports your macOS version, what protection it claims to provide, and whether its detection claims have current independent documentation. The 2023 Jamf and Apple statements are historical and do not offer a current cross-product comparison.
Quick Recap
Best Value
- Protect accounts with USB-A & NFC 2FA security key. Hardware-based authentication blocks phishing, credential theft & unauthorized access across cloud, enterprise & personal platforms.
- FIDO2 Level 2 certified Security Key. TAA compliant and supports Apple ID, Microsoft Azure/Entra ID, AWS, Google, Facebook, Salesforce, DUO & more. Works with Chrome, Safari & Edge across major OS.
- Plug & play USB-A Security Key with NFC tap login. No software, drivers or batteries required. Works with Windows PC, MacBook, iPhone, Android & Chromebook for fast, secure authentication.
- Built with FIPS 140-2 Level 3 secure element for advanced encryption. Trusted by IT teams, healthcare, education & government for secure authentication and identity protection.
- IP68 waterproof, dustproof & crush-resistant design. Supports FIDO2, U2F, OTP, PIV, Mini Driver & smart card login. Durable USB security key for long-term enterprise and daily use.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
