For years, the implicit bargain of buying a Mac was simple: pay more upfront, worry less about viruses. That assumption is eroding fast.
A newly discovered malware operation is targeting macOS users through counterfeit versions of popular applications, deploying an information-stealing payload that can quietly harvest passwords, cryptocurrency wallets, browser data, and system credentials before victims realize anything is wrong. The campaign, identified by researchers at the cybersecurity firm Moonlock, represents a growing trend of threat actors treating Apple’s desktop platform not as an impenetrable fortress but as an increasingly lucrative target with a user base conditioned to let its guard down.
The scheme works like this. Attackers create convincing replicas of well-known applications — Moonlock specifically flagged fake versions of the popular productivity tool Notion and the calendar app Fantastical, among others — and distribute them through fraudulent websites designed to look legitimate. When a user downloads and installs what they believe is a trusted application, the malware payload executes silently in the background, exfiltrating sensitive data to attacker-controlled servers. According to TechRadar, the campaign uses a strain of info-stealer malware that specifically targets macOS system credentials, browser-stored passwords, cookies, and cryptocurrency wallet files — the kind of data that can be monetized immediately on dark web marketplaces or used to compromise additional accounts through credential stuffing.
What makes this operation particularly effective isn’t technical sophistication alone. It’s social engineering at scale.
The fake download sites are polished enough to pass casual inspection, often appearing in search engine results alongside — or even above — legitimate sources. Moonlock’s researchers noted that some of the fraudulent pages closely mimic the design language and branding of the real applications, complete with accurate screenshots, feature descriptions, and download buttons that look exactly like what a user would expect. The malware itself is packaged inside standard macOS disk image (.dmg) files, the same format used by virtually every legitimate Mac application distributed outside Apple’s App Store.
This isn’t an isolated incident. It fits a pattern that security researchers have been tracking with increasing alarm over the past 18 months. The broader macOS malware market has matured rapidly, with info-stealers like Atomic Stealer (also known as AMOS), Poseidon Stealer, and various derivatives becoming available as malware-as-a-service offerings on underground forums. For a few hundred dollars a month, even technically unsophisticated criminals can rent access to these tools, customize them for specific campaigns, and begin harvesting data from Mac users who never expected to be targets.
The timing matters. Apple’s market share in personal computing has grown steadily, particularly among high-income professionals, creative workers, and cryptocurrency investors — precisely the demographic most likely to have valuable credentials and digital assets worth stealing. Threat actors follow the money, and the money has been moving toward Macs for years.
Apple does provide built-in protections. Gatekeeper, the company’s first line of defense, is designed to prevent unsigned or unnotarized software from running on macOS. XProtect, Apple’s built-in antimalware system, maintains a database of known malware signatures and can block recognized threats. But these defenses have limits. Gatekeeper can be bypassed when users manually override security warnings — something the fake download sites often instruct them to do, with step-by-step guides on how to right-click and open unsigned applications. And XProtect’s signature database, while regularly updated, inevitably lags behind newly compiled malware variants.
So the attackers have a window. Sometimes a wide one.
According to TechRadar’s reporting on the Moonlock findings, the malware in this campaign is capable of extracting data from multiple browsers simultaneously, targeting not just Safari but also Chrome, Firefox, Brave, and other Chromium-based browsers that store credentials locally. Cryptocurrency wallets — both browser extensions like MetaMask and standalone applications — are specifically targeted, with the malware scanning for wallet files and seed phrase backups stored on disk.
The financial incentive is obvious. A single compromised cryptocurrency wallet can yield tens or hundreds of thousands of dollars in stolen assets, with transactions that are effectively irreversible once confirmed on the blockchain. Browser-stored passwords, meanwhile, can unlock email accounts, banking portals, corporate VPNs, and cloud storage services, creating cascading compromise scenarios that extend far beyond the initial infection.
For enterprise security teams, the implications are serious. The rise of remote and hybrid work means corporate data increasingly lives on personal devices, or on company-issued Macs that employees also use for personal browsing and software installation. A single infected machine can become a beachhead into corporate networks, particularly if the stolen credentials include SSO passwords or VPN tokens. And because many organizations still treat macOS endpoints as lower-risk than their Windows counterparts — allocating fewer monitoring resources and less restrictive endpoint policies — compromised Macs can go undetected longer.
The broader macOS threat picture has been shifting for some time. In January 2024, researchers at multiple security firms documented a surge in Atomic Stealer campaigns distributed through malicious Google Ads, a technique known as malvertising that puts fake download links directly in front of users searching for legitimate software. The tactic is devastatingly effective because it exploits implicit trust in search engine results — users assume that if a link appears at the top of Google, it must be safe.
It usually isn’t.
Moonlock, which operates as the cybersecurity research arm of MacPaw, has been tracking the evolution of macOS-targeted malware with particular focus on how distribution methods have grown more sophisticated. The shift from crude phishing emails to polished fake websites and search engine manipulation represents a maturation of the threat that mirrors what Windows users experienced a decade ago. The playbook is the same. Only the platform has changed.
There are practical steps Mac users can take to reduce their exposure. The most important: download software only from the Mac App Store or directly from the developer’s verified website, never from links found through search engines or social media. Verify URLs carefully before downloading anything. Enable macOS’s built-in security features and don’t override Gatekeeper warnings unless you’re absolutely certain of the software’s provenance. Use a dedicated password manager rather than relying on browser-stored credentials, since most info-stealers target browser password databases as their first priority. And for anyone holding cryptocurrency, hardware wallets remain the single most effective defense against remote theft — if your private keys never touch an internet-connected device, they can’t be stolen by malware running on that device.
Two-factor authentication helps, but it isn’t a complete solution. Many modern info-stealers are designed to capture session cookies, which can allow attackers to hijack already-authenticated browser sessions without needing a second factor at all. The defense-in-depth approach — multiple layers of protection, none of which is assumed to be sufficient on its own — remains the only reliable strategy.
The Mac’s reputation as a virus-free platform was always somewhat overstated. But for most of the platform’s history, the relatively small market share made it an unattractive target for profit-motivated cybercriminals who could reach far more victims by focusing on Windows. That calculus has changed. Apple’s installed base is larger, wealthier, and more complacent about security than ever. And the criminals have noticed.
What Moonlock’s latest findings make clear is that the era of macOS security by obscurity is definitively over. The malware is real, it’s commercially available, it’s being distributed through increasingly convincing channels, and it works. The question for Mac users — individual and enterprise alike — is whether their security practices have caught up to a threat environment that no longer gives them a free pass.
For most, the honest answer is no. Not yet.
WebProNews is an iEntry Publication