A list features Unnamed Downloader, Poseidon, and PyStealer that Moonlock Lab has discovered in the wild.
Feb 5, 2025
Moonlock Lab
Latest threat report
Moonlock’s 2025 macOS threat report
For the second year in a row, MacPaw’s Moonlock Lab is sharing observations, research findings, and trends in macOS malware over the past year. This time, we focus less on the technical side of...
Dec 3, 2025
20 min read
About Moonlock Lab
Moonlock Lab is a team of security engineers that includes a former cybercrime investigator, a white-hat hacker, and a key figure of an Andy Greenberg book. They detect and study cyber threats daily, beefing up the defenses of Moonlock Engine.
Lab’s researchers have discovered new malware samples and AMOS variants, tracked down stealer developers, and exposed sophisticated malvertising campaigns. Their findings amass thousands of views, get featured in Forbes and Bleeping Computer. And when not chasing cyber threats, our experts hit the stage at RSA Webcast, Virus Bulletin, or Objective for the We.
More About Moonlock
Previous publications
Mac.c stealer evolves into MacSync: Now with a backdoor
In April 2025, a new macOS stealer developer emerged under the alias “mentalpositive.” Their stealer, mac.c, wasn’t sophisticated. It wasn’t particularly stealthy or feature-rich at launch, either. However, it did have one important...
Sep 12, 2025
7 min read
Atomic macOS Stealer now includes a backdoor for persistent access
Atomic macOS Stealer (AMOS), a popular piece of stealer malware for macOS, has just received a major update. For the first time, it’s being deployed with an embedded backdoor. This change allows attackers...
Jul 4, 2025
12 min read
“Anti-Ledger” malware: The battle for Ledger Live seed phrases
Hackers are increasingly exploiting the trust that crypto owners place in cold wallets, turning the very tools meant to secure assets into attack surfaces. The recent ByBit heist has shaken the crypto industry...
May 22, 2025
10 min read
Experts of Moonlock Lab
Lab making headlines
Moonlock's threat report reveals disturbing trends that are turning Apple’s platform into a lucrative target for cybercriminals.
Dec 5, 2024
Moonlock Lab examines attackers' evolving tactics, from cheap, plug-and-play malware kits to sophisticated AI-generated exploits.
Dec 4, 2024
Here’s how Moonlock Lab obtained and analyzed a version of Atomic Stealer that primarily targets the Ledger Live app.
Aug 24, 2024
Follow Moonlock Lab on X
1/ We investigate a multi-stage #macOS stealer chain (likely a variant of #DigitStealer) with a Bash loader + JXA + AppleScript, obfuscation in place. Two files from this flow are undetected on VirusTotal at the time of writing, others have 2-3 detections.
Initial research
Following @g0njxa’s report (https://x.com/g0njxa/status/2010073225884213533)on a fake meeting platform Sonance delivering signed macOS and Windows malware, I checked the DMG🍏
This DMG drops a Swift app named Freeze IO.
Interestingly, it's not a typical infostealer, but a RAT / downloader. What it
We encourage everyone to read about how macOS malware evolved in 2025, with lots of references to some of the best researchers who regularly spot these things in the wild! 🧙
And of course @patrickwardle did a tremendous work preparing this report! What a year!
🎉 A decade of Mac malware research 🎉
Just published our 10th annual “The Mac Malware of <year>” report ...2025 edition!
For each new sample of 2025, covers:
🔎 IoCs 💉 Infection 💾 Persistence 📡 Capabilities ☣️ Samples for download
Dive in 👇
https://objective-see.org/blog/blog_0x84.html
1/ We noticed an ongoing campaign targeting #macOS users who use Trezor Suite software (again!). This time - PyInstaller is used. Looks very similar to the one we reported earlier:
More below 🧵
But let’s get back to the seed phrase phishing part. The content shown to a victim is crafted to trick them into thinking that the page actually should help them recover their wallet. You might remember one of our earlier posts regarding almost the same technique used:
1/ Recently, after a post from @malwrhunterteam (), we took a deeper look at what tries to seem like a ‘PDF viewer’, but is rather a modified version of #macOS #Banshee stealer. 🧵
"/Users/Malcome/Downloads/OPERATION SHAWDOWFALL/PDF.viewer/PDF.viewer/Sources/"
🤔
🤷♂️
2025 showed clearly — the myth of a “safe Mac” is dead.
According to Moonlock’s annual threat report:
• macOS backdoor variants 📈 up by 67%
• Stealer malware families 📈 up by 17%
• Over 80 countries hit by major stealer campaigns
In short: Macs are no longer “safe by
IOCs 🧙
stickvpn[.]com
apple-service[.]bet
2cbdfab09e85f78c6764742672604d689bb98476e8ed8369f14b6bad4dbc3c3b
1/🕵️This morning @ttakvam slides into our DMs: "Hiya! I managed to unravel the next steps from that osascript from the DDR on Steam...". What he shared connected dots we didn't even know existed - linking @L0Psec's October discovery () to a threat actor
Alright here's another interesting one. More infostealer stuff but worth a look. There's a couple parts to this so I'll attempt to summarize. Thanks @malwrhunterteam for sharing :)
Starting with the initial mach-O, (readable strings?!?!) Ugly plist for persistence.
🧵
Moonlock has been verified by AV-TEST 🎉
AV-TEST independently evaluates antivirus software for accuracy and overall performance. Moonlock proved malware-proof on macOS and didn’t flag a single trusted file. That means it protects you from anything harmful while keeping your…
Remember our previous post regarding the #MacSync #phishing variant? Well, it seems this one started spreading among our users, specifically as #Trezor Suite app bundle.
We remind you to stay cautious and never input your seed phrase on such applications 🔎…
🔎 Seems like #Odyssey #macOS stealer crossed our upper tolerance band for the average detection rate on Nov 1st, indicating an active campaign.
Geography suggests the spread is global, with visible clusters in India, the US, APAC, and parts of Europe.
Missed our latest…