On August 8, the attacker compromised our macOS build machine through the Screen Sharing vulnerability. The observed payload was the same Monero cryptominer found on other affected machines. We believe that this attack was not targeted specifically towards Dolphin, as all indicators of compromise matched other machines infected with the cryptominer, and we did not observe any indications of data exfiltration or other payloads on the machine.

We eventually noticed that the machine was compromised on August 15 and shut it down. Because we were unaware that there was malware on the machine from August 8 to 15, we were using it during that period of time to produce new builds of Dolphin. This includes development versions between 2606-294 and 2606-302, as well as the 2606a hotfix release. Since the attacker had full control over the machine when these builds were produced, we became very concerned over the possibility that they could have been infected with malware.

Thankfully, after manually analyzing the contents of each build, we can report that none of the builds appear to be compromised with any malware. We also ran each build through VirusTotal and found no evidence of anything suspicious. However, if you are running any of these macOS builds, we recommend that users should update to the latest development or release version, out of an abundance of caution. We would also like to reiterate that only our macOS build machine was compromised during this incident, so users on Windows, Android, and Linux are unaffected.

Sheesh, the clanker fatigue and threats even hits a well organised veteran team like Dolphin.

The amount of vibe coded slop posted on the emulation subreddit is also getting brutal. It's nearly every other post. I only really go there to yoink posts from developers who don't post elsewhere, but thankfully nobody posts the slop here. I won't count assisted projects but pure vibe slop maybe I should add a rule banning it soon? Idk.