A list features Unnamed Downloader, Poseidon, and PyStealer that Moonlock Lab has discovered in the wild.
Feb 5, 2025
Moonlock Lab
Latest threat report
Moonlock’s mid-2026 macOS threat report
In the first 6 months of 2026, attackers didn’t invent anything new—they simply got much better at using what already worked. This has changed the security landscape, as a single signature scan is...
Jul 16, 2026
14 min read
About Moonlock Lab
Moonlock Lab is a team of security engineers that includes a former cybercrime investigator, a white-hat hacker, and a key figure of an Andy Greenberg book. They detect and study cyber threats daily, beefing up the defenses of Moonlock Engine.
Lab’s researchers have discovered new malware samples and AMOS variants, tracked down stealer developers, and exposed sophisticated malvertising campaigns. Their findings amass thousands of views, get featured in Forbes and Bleeping Computer. And when not chasing cyber threats, our experts hit the stage at RSA Webcast, Virus Bulletin, or Objective for the We.
More About Moonlock
Previous publications
Notorious hacker returns with a new Mac stealer targeting $10K+ crypto wallets
In 2023, a malware developer named 0xFFF rage-quit one of the most prominent underground hacking forums, leaving behind accusations and bad blood. In August 2024, 0xFFF came back under a new alias, alh1mik,...
Apr 8, 2026
17 min read
Fake VCs target crypto talent in a new ClickFix campaign
In a new investigation, Moonlock Lab has been tracking a malware campaign targeting cryptocurrency and Web3 professionals. The threat actors operate through fabricated venture capital identities, engage victims on LinkedIn with tailored job...
Mar 2, 2026
15 min read
6 key trends to watch in macOS malware in 2026
What we’re seeing in macOS malware development is a reflection of how cybercrime itself evolves. As security ecosystems mature, threat actors are creating malware that is more efficient and more resilient than ever...
Feb 3, 2026
9 min read
Experts of Moonlock Lab
Lab making headlines
Moonlock's threat report reveals disturbing trends that are turning Apple’s platform into a lucrative target for cybercriminals.
Dec 5, 2024
Moonlock Lab examines attackers' evolving tactics, from cheap, plug-and-play malware kits to sophisticated AI-generated exploits.
Dec 4, 2024
Here’s how Moonlock Lab obtained and analyzed a version of Atomic Stealer that primarily targets the Ledger Live app.
Aug 24, 2024
Follow Moonlock Lab on X
1/ We pulled apart a #macOS app_installer that's still FUD on VT. Parent sample shared by @malwrhunterteam. It ships as a fake Zoom app (com.zoom.helper) and the byte-identical payload also ships re-skinned as StreamYard (com.streamyard.helper).
Ad-hoc signed, no Team ID, no
1/ Spotted something we don’t usually get this cleanly from a #macOS #stealer chain.
After the paste-into-Terminal lure fires, the stager phones home here:
questlyric8[.]com/api/metrics/run?event=pasted
Seems the operators are measuring how the campaign spreads 👇
New #Mac #stealer in the wild: Sonoma. Crazy Evil's 2026 kit. Same crew we wrote about in 2024.
Impersonated brands we saw so far: StreamYard, Zoom, Slack, DocSend, Brave Talk, Toria, Waaako, Meendo, CavePay, Crystal Flip, Cốc Cốc.
Some fun facts:
- one chain fetched the
⚡️We currently observe an ongoing campaign mentioned by @ossmalware - utilizing NullReceiver and adding more IP addresses to its list. Last transaction happened hours ago.
This time, the same sender initiates transfers to a new address which decodes to 166.88.73[.]46.
Ref:
1/ Spent the morning on a batch of #macOS #infostealers and one of their components caught our eye: a keylogging thread literally named "goida.keyhammer".
Universal (fat) Mach-O, x86_64 + arm64, ad-hoc signed, no Team ID. All uploaded to VT on Aug 4. Some of them are 0/70
Few weeks after, I'm still thinking how incredible #OFTW in Berlin was🔥
Loved chatting with so many of you after my presentation :3
The panel with @patrickwardle, @gergely_kalman and @naehrdine was an absolute privilege, listening to their thoughts and experience was something
1/ DPRK's Contagious Interview campaign is still running, the infrastructure is rotating often, and the payload is aimed at Mac users (among others).
We analyzed some stages of OtterCookie chain. The malware increasingly looks like it was written with AI. Thanks to
Current iteration of OtterCookie is the most displeasure I've had analyzing. They've now basically fully embraced AI and are just constantly churning out garbage for us to look at.
I've had to jump through so many deobfuscation hoops to get to something more readable. At least
📜 New in our mid-2026 macOS threat report: 20% of malware carried valid Apple Developer certs, ClickFix drove half of initial access, and fake AI-tool installers (Claude, ChatGPT, Codex) are now a top disguise.
#MacOS is no longer the safe bet.
Read it 👉