Apple EFI malware triad: Mojo/Thor/Loki?

Without additional data this magic EFI rootkit appears to be bogus -> https://t.co/IpkfgYRpa3. The mojo kext doesn't have anything malicious

— The Uninitialized Pointer Guru 🥇 (@osxreverser) October 6, 2017

Without a proper external flash dump and additional data it's pretty much hard to conclude anything from what was published.

— The Uninitialized Pointer Guru 🥇 (@osxreverser) October 6, 2017

The ThorUtil.efi is also legit from the FirmwareUpdate packages.

— The Uninitialized Pointer Guru 🥇 (@osxreverser) October 6, 2017

MojoKDP is definitely not malicious, it can be found in RecoveryMode prelinked kernel file. Doesn't exist in normal system boot.

— The Uninitialized Pointer Guru 🥇 (@osxreverser) October 7, 2017