MalwareBazaar Database

This page shows some basic information the YARA rule Foxveil_Loader_TaskInfo_NoFw_Variant including corresponding malware samples.

Database Entry

YARA Rule:Foxveil_Loader_TaskInfo_NoFw_Variant
Create hunting rule
Description:Foxveil macOS loader (ClickFix -> AMOS), quill/stratos generation, framework-agnostic: fat x86_64+arm64 linking libSystem+libc++ with any number of system frameworks (zero since 2026-10-30) and no framework, CF, objc or swift import, the task_info/mach_task_self_/pthread_once resolver core in both slices, and a 128 KB-1 MB __DATA_CONST,__const payload section in both slices
Firstseen:2026-10-31 13:24:41 UTC
Lastseen:2026-11-02 00:35:05 UTC
Sightings:30

Malware Samples

The table below shows all malware samples that matching this particular YARA rule (max 1000).

Firstseen (UTC)SHA256 hashTagsSignatureReporter