A list features Unnamed Downloader, Poseidon, and PyStealer that Moonlock Lab has discovered in the wild.
Feb 5, 2025
Moonlock Lab
Latest threat report
Notorious hacker returns with a new Mac stealer targeting $10K+ crypto wallets
In 2023, a malware developer named 0xFFF rage-quit one of the most prominent underground hacking forums, leaving behind accusations and bad blood. In August 2024, 0xFFF came back under a new alias, alh1mik,...
Apr 8, 2026
17 min read
About Moonlock Lab
Moonlock Lab is a team of security engineers that includes a former cybercrime investigator, a white-hat hacker, and a key figure of an Andy Greenberg book. They detect and study cyber threats daily, beefing up the defenses of Moonlock Engine.
Lab’s researchers have discovered new malware samples and AMOS variants, tracked down stealer developers, and exposed sophisticated malvertising campaigns. Their findings amass thousands of views, get featured in Forbes and Bleeping Computer. And when not chasing cyber threats, our experts hit the stage at RSA Webcast, Virus Bulletin, or Objective for the We.
More About Moonlock
Previous publications
Fake VCs target crypto talent in a new ClickFix campaign
In a new investigation, Moonlock Lab has been tracking a malware campaign targeting cryptocurrency and Web3 professionals. The threat actors operate through fabricated venture capital identities, engage victims on LinkedIn with tailored job...
Mar 2, 2026
15 min read
6 key trends to watch in macOS malware in 2026
What we’re seeing in macOS malware development is a reflection of how cybercrime itself evolves. As security ecosystems mature, threat actors are creating malware that is more efficient and more resilient than ever...
Feb 3, 2026
9 min read
Moonlock’s 2025 macOS threat report
For the second year in a row, MacPaw’s Moonlock Lab is sharing observations, research findings, and trends in macOS malware over the past year. This time, we focus less on the technical side of...
Dec 3, 2025
20 min read
Experts of Moonlock Lab
Lab making headlines
Moonlock's threat report reveals disturbing trends that are turning Apple’s platform into a lucrative target for cybercriminals.
Dec 5, 2024
Moonlock Lab examines attackers' evolving tactics, from cheap, plug-and-play malware kits to sophisticated AI-generated exploits.
Dec 4, 2024
Here’s how Moonlock Lab obtained and analyzed a version of Atomic Stealer that primarily targets the Ledger Live app.
Aug 24, 2024
Follow Moonlock Lab on X
Kseniia Yamburh from MacPaw will be speaking at Virus Bulletin 2026 @virusbtn , one of the long-running international conferences for malware research and threat intelligence together with Joan Garcia.
Their talk, “Mac&Cheese: cooking up the Digit Stealer recipe,” dives into a
1/ A new #macOS #stealer in the wild, analyzed after being spotted by @malwrhunterteam🚨
A Rust-compiled, universal (x86_64 + arm64) infostealer targeting passwords, Keychain, browser data, Telegram, hardware wallets, and Apple Notes - all in one binary. It’s also different from
Here is another related sample with the same TeamID and Signature, first seen in March this year, and detected as Cobaltstrike on VT:
b62756002243678c0017f464c71379a41fced350ad57566fa8322d0d023d51dd
The earliest one we managed to find is this one, from December 2025:
Here's two potentially interesting ones shared by @malwrhunterteam. They have many adaptixC2 detections BUT were signed. com.shizhuang.itrustd. Several other files have this signature.
🧵
1/ We spotted three macOS stealer samples on VirusTotal - fresh enough that they're still at 0/72 a week after upload. Known malware family being delivered as a fake build of Codex for Mac. Sharing what we pulled out 🧵
3
Ever seen a malware dev just… come back?
A known macOS threat actor resurfaced under a new identity — now behind a stealer called notnullOSX.
It’s already active, evolving, and targeting high-value data.
Feels like macOS threats are getting a lot more persistent lately.