Heartbreaker macOS Ransomware Rebuilds Itself; ISO/IEC Publishes AI Security Standard

Heartbreaker Ransomware Evades Detection

Security researcher Patrick Wardle analyzed Heartbreaker, a Rust-based macOS ransomware sample uploaded to VirusTotal in May 2025. This ransomware attempts to establish persistence via a LaunchAgent and encrypts files within the user's Downloads folder. A notable feature is its ability to recompile itself from embedded source code, randomizing identifiers and adding junk functions to change its hash and evade antivirus detection. It can even install Rust if necessary for this process.

Current Limitations and Future Implications

Wardle believes Heartbreaker is not a significant threat in its current state. It uses a single hardcoded AES key, which allows for free file recovery. Additionally, its self-rebuilding mechanism relies on a Rust framework that is no longer publicly available. Despite these limitations, the self-recompiling capability represents an advanced technique for ransomware to bypass traditional signature-based detection methods.

New Standard for AI System Security

ISO and IEC have published ISO/IEC 27090, a new standard providing guidance for detecting and mitigating security threats specific to artificial intelligence systems. This standard covers risks such as data poisoning and model theft throughout the AI system lifecycle. It is designed to work alongside existing security standards like ISO/IEC 27001 and 27002.

Addressing AI-Specific Risks

The ISO/IEC 27090 standard highlights the risk of corrupted operational data being incorporated into future model versions through retraining processes. This new guidance is important for organizations developing and deploying AI, as it provides a framework to manage the unique security challenges presented by AI technologies, ensuring more secure and reliable AI deployments.