MalwareBazaar Database

This page shows some basic information the YARA rule Foxveil_Loader_TaskInfo_NoFw_Bulk_Variant including corresponding malware samples.

Database Entry

YARA Rule:Foxveil_Loader_TaskInfo_NoFw_Bulk_Variant
Create hunting rule
Description:Foxveil macOS loader (ClickFix -> AMOS), quill/stratos generation after the 2026-11-05 13:00 UTC payload bulking: fat x86_64+arm64 linking only libSystem+libc++ (no framework, CF, Sec, objc or swift import), the task_info/mach_task_self_/pthread_once resolver core in both slices, and a 128 KB-4 MB __DATA_CONST,__const payload section in both slices; file up to 12 MB
Firstseen:2026-11-06 00:00:53 UTC
Lastseen:2026-11-07 01:09:23 UTC
Sightings:34

Malware Samples

The table below shows all malware samples that matching this particular YARA rule (max 1000).

Firstseen (UTC)SHA256 hashTagsSignatureReporter