MalwareBazaar Database

This page shows some basic information the YARA rule Foxveil_Loader_TaskInfo_FwRot_Variant including corresponding malware samples.

Database Entry

YARA Rule:Foxveil_Loader_TaskInfo_FwRot_Variant
Create hunting rule
Description:Foxveil macOS loader (ClickFix -> AMOS), quill/stratos generation with a rotated framework set: fat x86_64+arm64 linking libSystem+libc++ and two or more system frameworks (CoreFoundation no longer required) while importing nothing from any framework, CF, objc or swift, with the task_info/mach_task_self_/pthread_once resolver core in both slices inside a per-build random libc decoy import set
Firstseen:2026-10-31 13:24:41 UTC
Lastseen:2026-11-01 05:57:47 UTC
Sightings:7

Malware Samples

The table below shows all malware samples that matching this particular YARA rule (max 1000).

Firstseen (UTC)SHA256 hashTagsSignatureReporter