Mac ransomware downloaded about 6,500 times, Transmission rep says
The first known ransomware targeted at Apple Inc's Mac computers was only downloaded about 6,500 times, according to a representative for the Transmission project, whose software was used to launch the attack.
Context & Ripple Effects
A day after the first known ransomware targeting Macs surfaced inside the Transmission BitTorrent client, the project put a number on the blast radius: roughly 6,500 downloads before Apple revoked the developer certificate that made the infected installs possible. The figure matters because it sizes the incident as a contained event rather than a Mac-wide outbreak — but it arrived through a trusted download channel, not an OS exploit.
That channel is the real story arc here. Transmission was hit again months later when researchers found version 2.92 itself was infected during a one-day window, and by 2017 the same playbook had moved to HandBrake's hacked download server. Compromising a popular Mac app's distribution pipeline became a repeatable attack template.
First-order effects
- Users among the ~6,500 who downloaded the infected Transmission build faced encrypted files and a ransom demand, while Apple's certificate revocation cut off further infections immediately.
Second-order effects
- Popular open-source Mac apps become high-value targets precisely because they are trusted: Transmission's second infection and the HandBrake server breach show attackers returning to distribution channels rather than attacking macOS directly.
- Security vendors gain a commercial opening on a platform long marketed as low-risk — consistent with McAfee's report of Mac malware instances growing 744% in 2016 to over 450K, mostly adware bundling.
Third-order effects
- If the pattern holds, Mac security posture shifts from 'the platform is safe' to 'verify what you install,' pushing Apple toward tighter notarization of third-party software and pushing enterprises to treat Mac fleets like Windows fleets for endpoint risk.
- As the Mac user base widens — Stack Overflow's survey already counted 31% of developers on Mac — attackers' economics improve, which is why later incidents like Jamf's Final Cut Pro cryptojacking find target-rich, high-hardware-capability machines.
The trend: Mac malware is migrating from direct exploits against macOS toward poisoning the trusted software-supply chain that Mac users assume is safe.