Eltima downloads served Proton RAT

Eltima's public download path failed for one day in October 2017. Users who fetched Elmedia Player or Folx from the official site received macOS disk images wrapped around legitimate applications and OSX/Proton. The built-in automatic update path was not reported affected.

ESET confirmed the poisoned downloads on October 19, notified Eltima at 10:35 EDT, and saw the site serving clean packages again by 15:15 EDT. The malicious wrappers were signed with an Apple Developer ID issued to Clifton Grimm, not Eltima. Apple revoked that certificate.

The wrapper launched the real application as cover, then extracted and ran Proton. It asked for the administrator password through a fake authorization prompt, installed a LaunchAgent, and placed its updater under /Library/.rand/. The technique was direct: keep the user interface normal, then persist below it.

Proton was built to steal. Public analyses describe browser credentials and cookies, macOS keychain data, 1Password vaults, SSH private data, GnuPG files, VPN configurations, cryptocurrency wallets, host data, remote shell functions, file upload and download, and command execution. For infected Macs, reinstalling the operating system and rotating secrets were the practical recovery steps.