@moonlock_lab

Malware research lab @moonlock_com Assembled by @macpaw to detect and study cybersecurity threats.

moonlock.com/moonlock-lab
Joined June 2023
  • Tweets620
  • Following89
  • Followers1.8K
306Media
Our team recently published 2026 #macOS malware predictions: supply-chain + AI/workflow (MCP) abuse, signed/notarized stealth & multi-stage loaders, Macs as proxy infrastructure, and “upmarket” infostealers. Give it a read! 👇 moonlock.com/macos-malware-t…

6 trends in macOS malware

Here's what to watch out for in 2026.

moonlock.com
1
9
29
4,596
1/ New #macOS #malware, seems FUD for now, shared by @malwrhunterteam. A hidden-VNC (hVNC) implant that doesn't mirror your screen. It secretly clones your browser profile and drives a ghost copy of Chrome/Firefox with your live logins. Decided to track it as GhostProfile 👇
2
5
2
37
4,663
more replies
9/ Overall, it fits the macOS hVNC-as-a-service trend (first flagged ~2023) but uses a more unexplored CDP/BiDi profile-clone technique.
1
2
230
IOCs 🧙 SHA256 • Agent (Mach-O): 5681c400f0ed8431b3950e92864e52cffb0bf93a359edffb49e423ad5e8ef0b8 • Stager (shell): dce578f5af994c77785b96087e4fd4d8124482eab896dceb175a26342a84e31b Network • C2 domain: txrouteuifbfewfubewfbhgrabbing[.]xyz • Payload URL: hxxps://txrouteuifbfewfubewfbhgrabbing[.]xyz/wohnung/agent • Config fallback: server.txt (next to the binary) Filesystem • Install path: ~/Downloads/wohnung • Persistence: ~/Library/LaunchAgents/com[.]system[.]updater[.]plist • LaunchAgent label: com[.]system[.]updater • Session ID file: ~/Library/Application Support/.hvnc_id • Browser clone dirs: $TMPDIR/hvnc_clone_*
1
1
5
897
1/ We pulled apart a #macOS app_installer that's still FUD on VT. Parent sample shared by @malwrhunterteam. It ships as a fake Zoom app (com.zoom.helper) and the byte-identical payload also ships re-skinned as StreamYard (com.streamyard.helper). Ad-hoc signed, no Team ID, no notarization.
3
9
1
25
6,781
more replies
5/ Almost every string is encrypted at rest. A custom "cloudsync_impl::sobf::reveal()" XOR-decodes config at runtime, fed by 40+ compile-time-encrypted "CTEnc<N>" literals,  plus zero-width-character and "magic" encoders. Nothing greppable, almost nothing static AV can flag.
1
1
2
152
6/ IOCs 🧙 524a7bcc8edcadc6f4381459f79769e1ec534aa78f66e5c38a6678bd55cf2572 cc54d90920a73cc5e176664f61c6f601c95d693e431e79ae1148cb91e83c9235
1
3
133
1/ Spotted something we don’t usually get this cleanly from a #macOS #stealer chain. After the paste-into-Terminal lure fires, the stager phones home here: questlyric8[.]com/api/metrics/run?event=pasted Seems the operators are measuring how the campaign spreads 👇
2
6
24
1,726
more replies
4/ That doesn’t read like a careful recon. It reads like someone trying to muddy dynamic analysis, burying the interesting calls under a pile of whoami / uptime / memsize / /dev/null noise so sandboxes and analysts drown in events before they find the real C2 ..
1
1
3
204
IOCs 🧙 questlyric8[.]com grove-89[.]com grove-satin[.]com grove-12[.]com stride40[.]com bridge-schema[.]com node-slate[.]com leaf-core[.]com atlas-compass[.]com lyric-8[.]com weaveridge7[.]com amber-22[.]com ivory-34[.]com inktapestry[.]com weaveink12[.]com 46.101.207[.]191 104.248.194[.]193 165.232.73[.]74 Path: /api/metrics/run Queries: - event=pasted - event=stager - event=started&stage=boot SHA256: 13b868b3ea8b492e7fbab1ca04535c53d0930650185b5a082cd59c1974689cd5 199cc8c0f0e46e3fa3d5a212d459352611fdc8d3c82b2ffb75a0c6861d1c1fb2 71781ad8adefb499aee9bcbe1a166e69ccc37a47066682f617d65c76d8cde88c 7ea6ff8b12c59aaae1ab6f4f5a57045dad5a8127954f3ffd3d1c154d40d7ca3a b9ec3261d633c289e51c5fa8842af4350efe68446df39cb995de82e0941d0f3c f2da3de51506f9195a8c3468487422a6c0fb1e00fdc6ec2ee2b7b6ed7bb49a0d 7baaa2d56dbd1b405f283746264c868ab27794cd92f2e253d76bdb14bdd97310 b6021fc5a6b7a2ecbe0cb5c69d51e3a06a695b2c789ba038290935e065b428e0 5e2b9c4bb7cb13f3c2bc5b01222cc5d7734085771df41ab9ae2c1d46912dd7bd 8bd1f64d8220f72f19dac3ec1007712c3df04339bc44c5f778f256583905745b a07994990f1976669d69febbe9603be9e10132fe9f6d6e8e4184fa91462cba72 24f906fe0a90bfe776d6c16482bbea4039ccd18f4289f3fe57184ad16bcb72a5 e9ca312454fca908193d6be707d22c702a34a276823b06c3c196bafc54e5d780 8145a7920d69ee42e12533f5ef8d5e1168cd574db3586cb30af82f54c66d2f1d 2e1c656bff2b0cf128e9f1ac108b63240c1a10f428b6eee1b887e526559e786d
1
6
208
Load more