Prixstep

It was bound to happen: the douchebag duo at Month of Apple Bugs included a rootkit in their recent Application Enhancer exploit.

Jason Harris says

More to the point: The individual who published this exploit has now gone firmly in my mind from white-hat security researcher to black hat hacker. He is not helping the OS X community in any way. White-hat security researchers do not install root kits that attempt to obfuscate themselves onto other people's machines.

True, but this shouldn't have come as a surprise: an earlier bug delivered a nasty surprise when run on a Windows machine.

(Additional note: I'd bet good money that LMH of Month of Apple Bugs is none other than Rixstep, due to their shared contempt of Rosyna.)