Moonlock Lab (@moonlock

Moonlock Lab

568 posts

Moonlock Lab

@moonlock_lab

Malware research lab @moonlock_com Assembled by @macpaw to detect and study cybersecurity threats.

moonlock.com/moonlock-lab

Joined June 2023

Pinned
Moonlock Lab
@moonlock_lab
Feb 5
Our team recently published 2026 #macOS malware predictions: supply-chain + AI/workflow (MCP) abuse, signed/notarized stealth & multi-stage loaders, Macs as proxy infrastructure, and “upmarket” infostealers. Give it a read! 👇
6 trends in macOS malware
From moonlock.com
Moonlock Lab
@moonlock_lab
16h
📜 New in our mid-2026 macOS threat report: 20% of malware carried valid Apple Developer certs, ClickFix drove half of initial access, and fake AI-tool installers (Claude, ChatGPT, Codex) are now a top disguise. #MacOS is no longer the safe bet. Read it 👉
Mid-2026 macOS malware threat report
From moonlock.com
Moonlock Lab
@moonlock_lab
Jul 23
1/ New #macOS bash dropper - 0 hits on VT. Shared by @malwrhunterteam. Self-deletes on launch. Delivers a binary from weekly-up[.]online while pushing a fake Zoom, Teams, or SystemApp as cover. Might be related to Contagious Interview, however no strong confirmation yet. 🧵
Moonlock Lab
@moonlock_lab
Jul 8
A recent surge in the #Odyssey stealer on #macOS has hit 100+ countries. What this variant does: - Harvests passwords, cookies & autofill from Chrome, Brave, Edge, Vivaldi, Opera, Arc, Firefox/Waterfox - Steals wallet files from 16+ crypto apps (Electrum, Exodus, Ledger Live,
Moonlock Lab
@moonlock_lab
Jun 25
1/ New #macOS (crossplatform) sample: a full-featured remote access trojan masquerading as MicrosoftSystem64 and using #huggingface legitimate infrastructure for its C2 activities. JavaScript payload + RAT inside a Mach-O binary. Findings below 👇