Yesterday, I noticed that, starting at 12:40, many thousands files had been automatically deleted from my drive. The computer is a Macbook Pro with a recent version of Mac OS X Yosemite. Since many folders are under Git version control, I could run a git status, which revealed deleted files in all those directories. I tried to detect a pattern, not using Got alone of course, and it seemed that files were deleted based on their extension.
- Deleted: png, pdf, html, mp3, tex, sh, java, cpp, and more
- not deleted: sty, toc, and more
The entire filesystem was affected by this, with probably 100K files deleted in total (10K images alone).
At least a very large subset of the files were in Trash, with the earliest timestamp set to about 12:40 yesterday; it seems that the deletions continued for more than an hour.
The computer was in my custody at the precise time when the files were deleted (based on their timestamp in Trash). I was home alone at the time, so I can rule out anyone manually deleting the files as a prank. Given the scale of the incident the files were most likely programmatically deleted.
Does this pattern of deleted files match any well-known, but unknown to me and my searches, Mac malware that is currently doing the rounds?
I have completely wiped the system.