Jamf Threat Labs Archives • Daily CyberSecurity

Fake Zoom Installer Drops Overlord RAT on macOS Fake Zoom installer delivering Overlord RAT on macOS via a .NET downloader

Fake Zoom Installer Drops Overlord RAT on macOS

Do Son August 13, 2026

At a glance Malware family Overlord (open-source RAT framework) Threat actor Unattributed (suspected DPRK links noted, not...

CrashStealer: New macOS Infostealer Poses as Apple Crash Reporter to Steal Wallets and Passwords CrashStealer macOS infostealer posing as Apple crash reporter to steal browser and crypto wallet data

CrashStealer macOS infostealer posing as Apple crash reporter to steal browser and crypto wallet data

CrashStealer: New macOS Infostealer Poses as Apple Crash Reporter to Steal Wallets and Passwords

Do Son July 20, 2026

At a Glance Field Detail Malware family CrashStealer (native C++ macOS infostealer) Threat actor Unattributed; part of...

PamStealer macOS Malware Poses as Maccy to Steal Passwords PamStealer macOS malware delivering a Rust infostealer through a fake Maccy clipboard app

PamStealer macOS malware delivering a Rust infostealer through a fake Maccy clipboard app

PamStealer macOS Malware Poses as Maccy to Steal Passwords

Do Son July 10, 2026

Malware family PamStealer (Rust-based macOS infostealer) Threat actor Not attributed by Jamf Targets Apple Silicon Mac users;...

GhostClaw Rising: AI-Assisted Malware Campaign Targets macOS via Malicious GitHub Repos GhostClaw Malware GitHub Supply Chain

GhostClaw Rising: AI-Assisted Malware Campaign Targets macOS via Malicious GitHub Repos

Do Son March 26, 2026

Jamf Threat Labs has released a new report detailing the evolution of GhostClaw, a sophisticated malware campaign...

“Contagious” Code: North Korean Hackers Infiltrate Developer Workflows via Visual Studio Code BlueNoroff macOS Attack GhostCall Campaign Carding Underground Bulletproof Hosting DPRK Contagious Interview, npm Flood Stonefly group -HiatusRAT Actors

BlueNoroff macOS Attack GhostCall Campaign Carding Underground Bulletproof Hosting DPRK Contagious Interview, npm Flood Stonefly group -HiatusRAT Actors

“Contagious” Code: North Korean Hackers Infiltrate Developer Workflows via Visual Studio Code

Do Son January 21, 2026

The “Contagious Interview” campaign, a sophisticated cyber-espionage operation attributed to North Korean (DPRK) threat actors, has evolved...

Spy vs. Spy: Predator Malware Now Hunts the Researchers OSX/Amos Stealer Electron ASAR Trojan MioLab Malware macOS Security MacSync Stealer macOS Malware ambar-src npm Malware Supply Chain Typosquatting Matryoshka Mac Malware ClickFix Crypto Scam Infostealer Evolution macOS Malware Predator Spyware Intellexa Anti-Analysis XCSSET macOS Malware, Xcode Supply Chain

OSX/Amos Stealer Electron ASAR Trojan MioLab Malware macOS Security MacSync Stealer macOS Malware ambar-src npm Malware Supply Chain Typosquatting Matryoshka Mac Malware ClickFix Crypto Scam Infostealer Evolution macOS Malware Predator Spyware Intellexa Anti-Analysis XCSSET macOS Malware, Xcode Supply Chain

Spy vs. Spy: Predator Malware Now Hunts the Researchers

Do Son January 20, 2026

The commercial spyware industry isn’t just building tools to spy on victims; they are building tools to...

The Notarized Nightmare: New MacSync Stealer Bypasses Gatekeeper to Hijack Mac Devices OSX/Amos Stealer Electron ASAR Trojan MioLab Malware macOS Security MacSync Stealer macOS Malware ambar-src npm Malware Supply Chain Typosquatting Matryoshka Mac Malware ClickFix Crypto Scam Infostealer Evolution macOS Malware Predator Spyware Intellexa Anti-Analysis XCSSET macOS Malware, Xcode Supply Chain

The Notarized Nightmare: New MacSync Stealer Bypasses Gatekeeper to Hijack Mac Devices

Do Son December 24, 2025

The cat-and-mouse game between Apple’s security protocols and malware authors has taken a stealthy turn. A new...

ChillyHell: A New macOS Backdoor Bypassed Apple Notarization for Years OSX/Amos Stealer Electron ASAR Trojan MioLab Malware macOS Security MacSync Stealer macOS Malware ambar-src npm Malware Supply Chain Typosquatting Matryoshka Mac Malware ClickFix Crypto Scam Infostealer Evolution macOS Malware Predator Spyware Intellexa Anti-Analysis XCSSET macOS Malware, Xcode Supply Chain

ChillyHell: A New macOS Backdoor Bypassed Apple Notarization for Years

Do Son September 11, 2025

Jamf Threat Labs has uncovered a new variant of the ChillyHell malware family—an advanced, modular backdoor for...

New macOS Infostealer Slips Past Apple’s Defenses with Code Signing and Notarization macOS Infostealer, Apple Notarization Bypass

New macOS Infostealer Slips Past Apple’s Defenses with Code Signing and Notarization

Do Son July 18, 2025

Jamf Threat Labs has uncovered a sophisticated new macOS infostealer variant that managed to bypass Apple’s security...