Hacker News Reader

Check for the existence of these files:

~/Library/._insu (empty file used to signal the malware to delete itself)

/tmp/agent.sh (shell script executed for installation callback)

/tmp/version.json (file downloaded from from S3 to determine execution flow)

/tmp/version.plist (version.json converted into a property list)

I think Malwarebytes was the company first identifying the thread. Correction : it was Red Canary working with Malwarebytes.