Without additional data this magic EFI rootkit appears to be bogus -> https://t.co/IpkfgYRpa3. The mojo kext doesn't have anything malicious
— The Uninitialized Pointer Guru 🥇 (@osxreverser) October 6, 2017
Without a proper external flash dump and additional data it's pretty much hard to conclude anything from what was published.
— The Uninitialized Pointer Guru 🥇 (@osxreverser) October 6, 2017
The ThorUtil.efi is also legit from the FirmwareUpdate packages.
— The Uninitialized Pointer Guru 🥇 (@osxreverser) October 6, 2017
MojoKDP is definitely not malicious, it can be found in RecoveryMode prelinked kernel file. Doesn't exist in normal system boot.
— The Uninitialized Pointer Guru 🥇 (@osxreverser) October 7, 2017
Mojo / Thor / Loki are a triad of malware that infects the EFI of Apple MacBooks.[…]
