macOS Malware Archives • Daily CyberSecurity

New MacSync macOS Infostealer Targets Crypto Wallets

Diagram of the new MacSync macOS infostealer showing how the MacSync macOS infostealer infects Apple devices

New MacSync macOS Infostealer Targets Crypto Wallets

Do Son September 29, 2026

A new MacSync macOS infostealer spreads via fake apps. Learn how the MacSync macOS infostealer abuses iCloud to compromise Apple systems.

PamStealer macOS Malware Spreads via Fake Wavel Crypto App Diagram of the new PamStealer macOS infostealer showing how the PamStealer macOS infostealer infects Apple devices

Diagram of the new PamStealer macOS infostealer showing how the PamStealer macOS infostealer infects Apple devices

PamStealer macOS Malware Spreads via Fake Wavel Crypto App

Do Son September 28, 2026

A new PamStealer macOS infostealer spreads via fake Wavel apps. Learn how the PamStealer macOS infostealer steals system passwords and browser data.

TraderTraitor macOS Backdoors Target IT Service Firms CloudComputating - QSC framework

TraderTraitor macOS Backdoors Target IT Service Firms

Do Son September 28, 2026

SentinelOne discovered how new TraderTraitor macOS backdoors hit IT firms. Learn how TraderTraitor macOS backdoors use weaponized Terraform files.

macOS ClickFix Malware Exploits Polygon C2 macOS ClickFix malware campaign infection flow and macOS ClickFix malware execution diagram

macOS ClickFix Malware Exploits Polygon C2

Do Son August 28, 2026

A new macOS ClickFix malware campaign hides C2 servers on the blockchain. See how this macOS ClickFix malware steals crypto wallets and credentials.

AmnesiaStealer macOS Infostealer Hacks Apple Devices

AmnesiaStealer macOS infostealer malware diagram detailing the new AmnesiaStealer macOS infostealer

AmnesiaStealer macOS Infostealer Hacks Apple Devices

Do Son August 19, 2026

Jamf Threat Labs has discovered a new AmnesiaStealer macOS infostealer malware. The AmnesiaStealer macOS infostealer steals data and hijacks browsers.

Fake Zoom Installer Drops Overlord RAT on macOS Fake Zoom installer delivering Overlord RAT on macOS via a .NET downloader

Fake Zoom Installer Drops Overlord RAT on macOS

Do Son August 13, 2026

A fake Zoom installer delivers Overlord RAT on macOS via a .NET downloader. Jamf Threat Labs details the infection chain and defenses.

XCSSET v40 Malware Targets macOS Developers Through Xcode XCSSET v40 malware infection chain showing Xcode project supply chain attack on macOS

XCSSET v40 malware infection chain showing Xcode project supply chain attack on macOS

XCSSET v40 Malware Targets macOS Developers Through Xcode

Do Son August 6, 2026

XCSSET v40 malware infects macOS developers through poisoned Xcode projects on GitHub, then hides in memory. Unit 42 found 17 modules and Chrome hijacking.

ClickLock Stealer Locks macOS Screens Until Victims Hand Over Their Password ClickLock Stealer macOS malware fake Cloudflare ClickFix Terminal prompt stealing passwords

ClickLock Stealer macOS malware fake Cloudflare ClickFix Terminal prompt stealing passwords

ClickLock Stealer Locks macOS Screens Until Victims Hand Over Their Password

Do Son July 21, 2026

ClickLock Stealer is macOS malware that freezes your Mac until you type your password. Group-IB found 100+ victims across 33 countries.

CrashStealer: New macOS Infostealer Poses as Apple Crash Reporter to Steal Wallets and Passwords CrashStealer macOS infostealer posing as Apple crash reporter to steal browser and crypto wallet data

CrashStealer macOS infostealer posing as Apple crash reporter to steal browser and crypto wallet data

CrashStealer: New macOS Infostealer Poses as Apple Crash Reporter to Steal Wallets and Passwords

Do Son July 20, 2026

CrashStealer is a native C++ macOS infostealer posing as Apple's crash reporter. Jamf details its notarized dropper, AES-GCM theft, and persistence.

PamStealer macOS Malware Poses as Maccy to Steal Passwords PamStealer macOS malware delivering a Rust infostealer through a fake Maccy clipboard app

PamStealer macOS malware delivering a Rust infostealer through a fake Maccy clipboard app

PamStealer macOS Malware Poses as Maccy to Steal Passwords

Do Son July 10, 2026

PamStealer macOS malware hides in a fake Maccy app and drops a Rust infostealer that checks your password via PAM before stealing it.

macOS Cryptocurrency Malware Powers Stealthy JINX-0164 Operations macOS cryptocurrency malware JINX-0164 developer campaign

macOS Cryptocurrency Malware Powers Stealthy JINX-0164 Operations

Do Son June 3, 2026

A dangerous macOS cryptocurrency malware wave drives the latest JINX-0164 developer campaign. Learn how to secure your repositories now.

The Billion-Dollar Invite: How UNC1069’s Fake Meetings Hijack Crypto Fortunes UNC1069 Phishing BlueNoroff Crypto Theft

The Billion-Dollar Invite: How UNC1069’s Fake Meetings Hijack Crypto Fortunes

Do Son April 14, 2026

North Korean group UNC1069 (BlueNoroff) targets Web3 with fake Zoom/Teams links. 164 domains blocked. Secure your crypto assets and browser extensions now!

Alert: Social Engineering Campaign Targets Open Source Developers via Slack Social Engineering Developer Security

Alert: Social Engineering Campaign Targets Open Source Developers via Slack

Do Son April 8, 2026

Attackers are impersonating Linux leaders on Slack to drop malware via fake Google Workspace links. Protect your dev environment—verify before acting!

Malicious VeloraDEX SDK Compromises Developer Machines via npm npm Supply Chain Attack @velora-dex/sdk Malware

Malicious VeloraDEX SDK Compromises Developer Machines via npm

Do Son April 8, 2026

A malicious update to @velora-dex/sdk (v9.4.1) drops a stealthy macOS backdoor on import. Learn how to detect the zsh.profiler infection and rotate secrets.

GhostClaw Rising: AI-Assisted Malware Campaign Targets macOS via Malicious GitHub Repos GhostClaw Malware GitHub Supply Chain

GhostClaw Rising: AI-Assisted Malware Campaign Targets macOS via Malicious GitHub Repos

Do Son March 26, 2026

Jamf Threat Labs uncovers GhostClaw, a macOS threat exploiting GitHub stars and AI workflows to steal credentials. Protect your dev environment today!

The High Cost of Free: Cracked Music Plugins Weaponized to Infect macOS with Odyssey Malware Odyssey Malware MacSyncStealer

The High Cost of Free: Cracked Music Plugins Weaponized to Infect macOS with Odyssey Malware

Do Son February 25, 2026

Security researchers uncover a massive macOS malware campaign using "cracked" audio plugins and "ClickFix" tactics to deliver Odyssey and MacSyncStealer.

Fake CEO, Real Hack: North Korea Uses AI Deepfakes to Steal Crypto UNC1069 Deepfake Attack Cryptocurrency Malware

Fake CEO, Real Hack: North Korea Uses AI Deepfakes to Steal Crypto

Do Son February 11, 2026

North Korean hackers (UNC1069) use AI deepfakes & "ClickFix" tactics to deploy SILENCELIFT malware. Learn how they target crypto firms via Zoom.

The “Compatibility” Trap: New Mac Malware Tricks Users into Bypassing TCC OSX/Amos Stealer Electron ASAR Trojan MioLab Malware macOS Security MacSync Stealer macOS Malware ambar-src npm Malware Supply Chain Typosquatting Matryoshka Mac Malware ClickFix Crypto Scam Infostealer Evolution macOS Malware Predator Spyware Intellexa Anti-Analysis XCSSET macOS Malware, Xcode Supply Chain

OSX/Amos Stealer Electron ASAR Trojan MioLab Malware macOS Security MacSync Stealer macOS Malware ambar-src npm Malware Supply Chain Typosquatting Matryoshka Mac Malware ClickFix Crypto Scam Infostealer Evolution macOS Malware Predator Spyware Intellexa Anti-Analysis XCSSET macOS Malware, Xcode Supply Chain

The “Compatibility” Trap: New Mac Malware Tricks Users into Bypassing TCC

Do Son February 9, 2026

Darktrace finds Mac malware using a fake "Compatibility Wizard" to trick users. The AppleScript attack bypasses TCC to drop a Node.js backdoor.

Macs Under Siege: New Infostealers Spread via WhatsApp & Fake Apps OSX/Amos Stealer Electron ASAR Trojan MioLab Malware macOS Security MacSync Stealer macOS Malware ambar-src npm Malware Supply Chain Typosquatting Matryoshka Mac Malware ClickFix Crypto Scam Infostealer Evolution macOS Malware Predator Spyware Intellexa Anti-Analysis XCSSET macOS Malware, Xcode Supply Chain

Macs Under Siege: New Infostealers Spread via WhatsApp & Fake Apps

Do Son February 6, 2026

Microsoft warns: Infostealers now target macOS & use WhatsApp worms. "Eternidade" & "Crystal PDF" steal credentials via cross-platform attacks.

Mac Users Beware: “MacSync” Malware Tricks You Into Hacking Yourself MacSync Malware macOS ClickFix

Mac Users Beware: “MacSync” Malware Tricks You Into Hacking Yourself

Do Son January 23, 2026

New macOS malware "MacSync" uses fake cloud installers & "ClickFix" terminal commands to steal crypto. It bypasses Gatekeeper to trojanize wallet apps.

Fake Windows Executables Target macOS: Inside the “MonetaStealer” Discovery MonetaStealer macOS Malware

Fake Windows Executables Target macOS: Inside the “MonetaStealer” Discovery

Do Son January 20, 2026

New macOS malware "MonetaStealer" disguises itself as a Windows .exe to steal crypto & Keychain data. It currently has zero VirusTotal detection.

“Contagious Interview” Goes macOS: North Korean Hackers Deploy Stealthy “DriverFixer” Stealer DriverFixer0428, Contagious Interview Cache Smuggling, ClickFix Evasion North Korean Cyber Espionage

DriverFixer0428, Contagious Interview Cache Smuggling, ClickFix Evasion North Korean Cyber Espionage

“Contagious Interview” Goes macOS: North Korean Hackers Deploy Stealthy “DriverFixer” Stealer

Do Son December 25, 2025

North Korea's "Contagious Interview" campaign uses DriverFixer0428 to steal macOS credentials via fake prompts and Dropbox C2. Stay alert!