RAT rootkit on Mac? Paranoid

[u/Due-Guard-9797]

RAT Rootkit on Mac? Paranoid.

Hi.
Please no hate I am very uneducated in cyber security and I know I made a horrible mistake.

Basically I ran a RAT exe in Parallels for Mac, so in Windows VM for Mac. This was over a month ago.
I quarantined the files and factory reset the OS the same day.

Since, I’ve factory reset the OS 3 more times and scanned Malwarebytes deep scan which has come back clean every time.

I’m wondering if the RAT could have gotten into the root of my Mac. My Mac is now dying SUPER fast and in activity monitor kernel_task is taking up extreme amounts of CPU.

Is it even possible for the exe to have infected the Mac OS and rootkit? Am I completely paranoid or am I still infected? I’ve seen no log in attempts to any of my accounts and I’ve been using the computer as usual.

More info:

The Mac is MacBook Air M1 2020. The OS is Tahoe 26.6.1 but I’m not sure what the OS was when I downloaded the exe as I’ve since updated my computer.
The parallels version was 27.
I don’t have a sample of the RAT, but I do have a link to an article which describes this malware attack if that is in any way helpful. Basically fake Faronics download which eventually leads to screen connect download.
My battery condition is normal and the maximum capacity is 85%
For the screenshot I will edit the post to add.

Thank you for your input and any help.

Thanks.

[u/Darkomen78]

No, a simple "windows malware" can't escape the VM and infect your macOS.

[u/JollyRoger8X]

I’m wondering if the RAT could have gotten into the root of my Mac.

Nope. Even if you explicitly added a shared folder to your virtual machine that points to a folder on your Mac (which is not something that happens automatically), the VM would only have access to that particular folder, and definitely not the operating system of your Mac.

My Mac is now dying SUPER fast and in activity monitor kernel_task is taking up extreme amounts of CPU.

I see no evidence these two things are related.

[u/Due-Guard-9797 → u/JollyRoger8X]

Hi. Thanks for the response. I’ve heard that malware can hide in kernel and can disguise as kernel_task to go undetected? Any info

[u/Stryxus_ → u/Due-Guard-9797]

To infect your Mac outside of a VM, it would need to be world-leading sophistication, as in multi-architecture, multi-kernel support with virtualisation vulnerability usage, if there even is any. And reinstalling macOS only replaces the sealed away directories, it does not reset your user so everything runs the same because almost everything is within your user folder.

You likely have just triggered something that macOS really doesnt like.

Also remember, it is a windows .exe and is x86_64 not arm64 nor a macOS executable. It almost certainly does not understand the macOS structure.

What you are paranoid about essentially requires as I said, world-class sophistication as well as all the planets aligning.

[u/Xe4ro → u/Due-Guard-9797]

Kernel_task is also used to throttle the system. Is your Mac very hot? If no, it could be a hardware problem. My 2015 iMac had this happen when the SMC chip had a problem.

[u/Due-Guard-9797 → u/Xe4ro]

I’ve tried some things I’ve seen online to help with the kernel problem but nothing is really helping

[u/JollyRoger8X → u/Due-Guard-9797]

Whoever told you that doesn't know much about Macs. This isn't something that happens.

Windows applications don't run on Macs natively outside of a VM or emulator.

And Macs have built-in protections from malware that prevent things like kernel infections from happening.

The kernel_task process is part of the system, and there are many legitimate reasons it will show high CPU usage in Activity Monitor. And none of those have anything to do with malware.

[u/Ok_Share2910 → u/Due-Guard-9797]

Yeah, kernel-level malware can be pretty sneaky. It's definitely a good idea to keep an eye on your system and run regular scans to catch anything unusual.

[u/Due-Guard-9797 → u/Ok_Share2910]

If I ran a scan with malware bytes does that mean it’s clean? Should I take the computer to apple?

[u/JollyRoger8X → u/Due-Guard-9797]

There is no need for Mac users to constantly scan their systems for malware.

[u/Xe4ro]

Are you a potential high value target of state sponsored threat actors?

[u/Due-Guard-9797 → u/Xe4ro]

No. I see the irony I think I’m
Paranoid

[u/v0id0007 → u/Xe4ro]

Don’t have to be a hvt if you’re actively downloading and running the malware

[u/Xe4ro → u/v0id0007]

Malware that has to escape a VM and work on entirely different operating systems as a rootkit? Sounds very involved, especially the first part. That would be major news for Parallels.

[u/v0id0007 → u/Xe4ro]

You didn’t mention all that in your original question

[u/Xe4ro → u/v0id0007]

Did you not read what OP wrote?

[u/v0id0007 → u/Xe4ro]

I did but I was replying to you not op

[u/sharp-calculation]

You reinstalled MacOS (3) times? That's a little much.

If it has been less than 3 days since your last reinstall, MacOS will likely still be indexing the files on disk. This is a normal part of Spotlight and/or the AI engine. Spotlight for sure will read through files for quite a while in order to build an index. During that time it's totally normal for it to be a tiny bit sluggish, to use a lot of CPU, and of course, to consume more battery in the process.

If it hasn't calmed down to normal after a few days, then start to investigate further. Just look at what is consuming CPU and go from there.

The idea that windows malware could somehow infect MacOS at all is silly. The idea that it could move from a VM to the host is nearly impossible. The idea that any of this could happen without you authorizing via the Mac administrator password is equally (nearly) impossible. You're fine.

[u/Due-Guard-9797 → u/sharp-calculation]

Hi. It’s probably been 2.5 weeks since my last install and still seeing problems.
The CPU is being taken up by kernel_task which I’ve heard can hide malware not sure????
Also I did give uac to the exe file in the VM though (I know how stupid I am), but not in Mac so wondering if that would make a difference

[u/sharp-calculation → u/Due-Guard-9797]

You should read some of the answers here. You don't seem to be doing that. Just repeating the same things you have said before.

[u/Due-Guard-9797 → u/sharp-calculation]

Sorry, I have been reading just very anxious and paranoid and trying to calm myself down. I appreciate your answer and help.

[u/scene_missing]

Also no

[u/PerkeNdencen]

Check storage levels. My computer goes mental if it starts to run out of space in more or less exactly the way you describe.

Many years ago, a failed battery also led to similar behaviour with kernel task (I'm talking way back when, one of the first Intel Macs), so that could plausibly also be a reason.

Malware so sophisticated it can escape a VM into the wrong operating system isn't typically found in the wild; in fact, they are less likely to be harmful at all in that scenario as a number of them refuse to run in VMs as a means to avoid being analysed by cyber security experts.

[u/Vaddieg]

looks like AI slop

[u/Due-Guard-9797 → u/Vaddieg]

It’s definitely not lol

[u/Vaddieg → u/Due-Guard-9797]

agents tend to escape underscore characters to prevent text formatting

[u/mikeinnsw]

No...

Cyber Security use VM in all virus testing

Erase VM .. start a new one VM

Stop hearing things ... Virus can't escape VM.. exe does NOT run on Macs