Moonlock Lab’s assessment of macOS threats during the first half of 2026 describes a threat landscape increasingly connected to Windows operations, driven heavily by social-engineering campaigns and increasingly interested in developer environments. Its report, published on July 16, says ClickFix was the dominant initial-access method in its assessment, while adware still accounted for about 65% of detections in Moonlock Engine endpoint telemetry.

The figures come from a company-authored threat-intelligence report, not an industry-wide survey. Moonlock does not provide the telemetry’s underlying sample size, geographic coverage or detailed methodology, so the percentages should be read as measurements from its own data rather than estimates of all Mac infections.

Contents

What changed in macOS campaigns

Moonlock says many campaigns in the first six months of 2026 operated across macOS and Windows using shared infrastructure, delivery chains and operator activity. That matters because a Mac incident may be part of a wider campaign rather than an isolated attack aimed only at Apple users.

The report also describes a shift in the kinds of lures used to deliver malware. Alongside fake CAPTCHA pages, video-call prompts and document-related instructions, Moonlock says attackers increasingly impersonated AI tools. It characterises techniques associated with state-sponsored operations as appearing in criminal campaigns, but those conclusions remain Moonlock’s assessments; the underlying reports behind several examples were not supplied for independent verification.

One recurring delivery method was ClickFix. Rather than silently exploiting a vulnerability, these campaigns persuade the victim to perform an action that appears to fix a technical problem. A webpage or document may instruct the user to copy a command and paste it into Terminal or Script Editor.

That distinction is important. Terminal and Script Editor are legitimate macOS tools, but a command pasted from an untrusted page can give the attacker the user’s own permissions. The attack therefore depends on social engineering—the manipulation of trust or user behaviour—as much as on malware code.

Moonlock says macOS Tahoe 26.4 introduced a warning when a command copied from a browser is pasted into Terminal. The report says later campaigns used the applescript:// URL scheme to open Script Editor instead, presenting an alternative route for the same general copy-and-execute pattern.

Why ClickFix is important

ClickFix can reduce the usefulness of defences focused mainly on downloaded files. If the victim manually executes a command, there may be no conventional malicious installer for a file scanner to identify at the beginning of the attack.

That does not make the method invisible or unbeatable. It shifts part of the security problem to recognising suspicious instructions and monitoring what the command does afterwards. Moonlock recommends that users avoid pasting commands into Terminal, Script Editor or similar system tools merely because a website, video call or document tells them to do so.

The report also advises downloading AI tools from official websites rather than search advertisements or shared links. This is a recommendation from Moonlock, not a separately tested guarantee that the proposed behaviour will prevent every campaign.

What Moonlock’s telemetry measured

Moonlock’s endpoint telemetry presents a mixed picture: common detections were dominated by adware, while the report places more targeted credential theft and backdoor activity in smaller categories.

For the first half of 2026, Moonlock reports approximately:

  • Adware: 65% of detections
  • Potentially unwanted applications: 25%
  • Stealers, backdoors, trojans and riskware combined: under 5%

These are detection shares within Moonlock Engine. They do not represent the percentage of Mac users affected by each category, the number of infections, or the damage caused by each type of malware. An adware detection can be more common without being more consequential than a smaller number of incidents involving stolen credentials or developer access.

A stealer is malware designed to collect information such as browser data, passwords, session tokens, credentials or cryptocurrency-wallet files. Moonlock says that among its stealer detections, Odyssey represented 62.7% and AtomicStealer—also known as AMOS—29.8%. It says the wider AMOS lineage accounted for more than nine in ten stealer detections.

Those figures also require care because malware families can be related through shared code and forks. A family-level percentage does not necessarily identify a single operator or a single campaign. Moonlock’s interpretation groups variants into a broader lineage, which can be useful for understanding reuse but limits what the percentages demonstrate about who was behind each sample.

Moonlock separately reports that SHub.Loader accounted for 90.7% of its stager detections. A stager or dropper is an initial component that retrieves or launches a later payload. Separating stagers from stealers matters: if a stager is blocked, the later stealer may never execute and therefore may not appear in stealer telemetry.

The report also contrasts endpoint data with VirusTotal submissions. It says unique malicious macOS samples grew by roughly 40% year over year and that distinct new malware families nearly doubled. VirusTotal sample submissions and endpoint detections measure different populations, however. More files submitted for analysis do not directly translate into a matching increase in infections or affected users.

Moonlock further says more than half of malicious Mach-O uploads were digitally signed, with roughly one-fifth carrying valid or recently revoked Apple Developer certificates. Code signing helps identify who signed an application; it does not by itself prove that the software is safe. A valid or recently revoked certificate can therefore be relevant evidence in an investigation without serving as a safety guarantee.

Why developer Macs are valuable targets

The report gives particular attention to developer environments. A compromised Mac used for software development may contain more than personal files: it can hold SSH keys, cloud credentials, package-manager tokens, source-control access and credentials for continuous integration and deployment systems.

Moonlock describes notnullOSX as a Go-based stealer aimed at cryptocurrency holders whose holdings exceeded $10,000. It says the malware was delivered through ClickFix or a fake wallpaper application and used Full Disk Access. According to the report, its modules sought data from Messages, Notes, Safari, cryptocurrency-wallet files, browser passwords, Telegram sessions, SSH keys, cloud credentials and package-manager tokens.

The significance of these targets extends beyond the individual Mac. A package-publishing credential or build-system token can allow malicious code to enter software that other users later install. In a software supply-chain attack, the attacker compromises a package, dependency, build system or publishing credential so that a trusted distribution route carries the malicious component downstream.

Moonlock describes a TeamPCP campaign that allegedly progressed from a Trivy compromise to stolen PyPI publishing credentials. It says malicious versions 1.82.7 and 1.82.8 of LiteLLM remained available for approximately five hours. These incident details are reported as Moonlock’s account; the underlying external materials were not provided in the research evidence for separate verification.

For security teams, Moonlock recommends treating Mac and Windows incidents as potentially connected, monitoring behaviour rather than relying only on signatures, and extending monitoring beyond endpoints when developer infrastructure is involved. It also recommends a 48- to 72-hour delay before deploying newly published package versions, allowing monitoring services and researchers time to identify suspicious releases.

What the report does not establish

Moonlock’s report is useful as a collection of observed campaigns, detections and hypotheses, but it is not a controlled study or a complete measurement of the macOS threat landscape.

It does not establish:

  • how common these threats are among all Mac users;
  • whether its detection percentages apply outside Moonlock Engine telemetry;
  • the absolute number of detections behind the reported shares;
  • the global or regional distribution of the activity;
  • whether the reported year-over-year sample growth represents equivalent growth in real-world infections;
  • that every campaign described as cross-platform had the same operators; or
  • that the recommended controls will prevent all of the described attacks.

The report combines endpoint telemetry, malware samples and selected incident descriptions. Those sources measure different things and cannot be added together as a single prevalence estimate. Its claims about attacker attribution, state-sponsored technique reuse and AI-operated attacks should therefore remain attributed to Moonlock unless the underlying evidence is independently checked.

What to watch next

The most important developments will be whether ClickFix campaigns continue moving between Terminal, Script Editor and other execution paths, and whether impersonated AI tools remain a major lure for macOS users.

For developers and software organisations, the more consequential question is whether attackers increasingly target package registries, AI-agent configurations, cloud credentials and CI/CD systems. If that happens, a single compromised development environment could become an entry point into software used by many downstream organisations.

Independent telemetry and incident reporting will also be important. They can help determine whether Moonlock’s reported category shares and growth estimates describe a broader change in macOS threats or primarily reflect the visibility and collection methods of one security vendor.

Sources