WTFMiner is an evasive cryptojacking malware spreading through pirated macOS apps. Its origins can be tied back to a torrent uploader who bundled the miner into multiple pirated macOS applications since 2019. By obtaining copies, Jamf charted its incremental development across three generations, each version employing additional stealth techniques. It uses dark web routing for stealthy communication, obfuscates itself as legitimate processes, and shuts down when Activity Monitor is opened. Latest variants avoid writing persistence to disk and rely on users launching the trojanized apps to initiate mining.