Record · corpus.blog/posts/01a0b68a-1f9a-7243-aa5e-72986f3c367a

The Mac Malware of 2025

objective-see.org · published 1 January 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at objective-see.org Wayback capture

1blogs citing

First cited: 21 Feb 2026
Most recent: 21 Feb 2026
Rank this month: not ranked
Links from this post: 132
Words captured: 23,517

Cited by

Blog

In the post

Date

pberba.github.io

AEMonitor: Monitoring Apple Events for Malware Analysis and Detection Read at the source ↗

21 Feb 2026

Links from this post

Link

Host

https://www.iru.com

iru.com

https://www.paloaltonetworks.com

paloaltonetworks.com

https://www.jamf.com/?utm_source=objective-see&utm_medium=sponsored-link&utm_campaign=next-gen-security&utm_content=2021-02-05_protect

jamf.com

https://moonlock.com

moonlock.com

https://www.sophos.com/

sophos.com

https://www.malwarebytes.com/

malwarebytes.com

https://www.iverify.io

iverify.io

https://hubs.ly/Q02BYLy80

hubs.ly

https://objective-see.com/malware.html

objective-see.com

https://objective-see.org/downloads/MacMalware_2025.pdf

objective-see.org

https://moonlock.com/moonlock-2024-macos-threat-report

moonlock.com

https://www.computerworld.com/article/3679730/jamf-q3-data-confirms-rapid-mac-adoption-across-the-enterprise.html

computerworld.com

https://objective-see.com/products/utilities.html

objective-see.com

https://objective-see.com/products/whatsyoursign.html

objective-see.com

https://objective-see.com/products/netiquette.html

objective-see.com

https://mothersruin.com/software/SuspiciousPackage/

mothersruin.com

https://www.hopperapp.com/

hopperapp.com

https://binary.ninja

binary.ninja

https://moonlock.com/2025-macos-threat-report

moonlock.com

https://github.com/objective-see/Malware/blob/main/Kitty.zip

github.com

https://x.com/L0Psec

x.com

https://x.com/Zolotkey

x.com

https://the-sequence.com/kitty-stealer

the-sequence.com

https://twitter.com/L0Psec/status/1880229244296655195?ref_src=twsrc%5Etfw

twitter.com

https://x.com/osint_barbie

x.com

https://github.com/objective-see/Malware/raw/main/DigitStealer.zip

github.com

https://twitter.com/txhaflaire/status/1989007806255542281?ref_src=twsrc%5Etfw

twitter.com

https://www.jamf.com/blog/jtl-digitstealer-macos-infostealer-analysis/

jamf.com

https://github.com/objective-see/Malware/raw/main/Phexia.zip

github.com

https://x.com/malwrhunterteam/

x.com

https://t.co/2CkU3cAp8Y

t.co

https://twitter.com/malwrhunterteam/status/1982844845090623658?ref_src=twsrc%5Etfw

twitter.com

https://twitter.com/malwrhunterteam?ref_src=twsrc%5Etfw

twitter.com

https://t.co/8NsOSBc610

t.co

https://twitter.com/L0Psec/status/1982917057500065893?ref_src=twsrc%5Etfw

twitter.com

https://x.com/moonlock_lab/status/1991619357441434057

x.com

https://x.com/L0Psec/status/1982917057500065893

x.com

https://phorion.io

phorion.io

https://t.co/hYwhwl8rhr

t.co

https://twitter.com/PhorionTech/status/1994092080843395562?ref_src=twsrc%5Etfw

twitter.com

https://phorion.io/blog/macos-paradox-stealer-used-in-solidity-open-vsx-extension-attack/

phorion.io

https://github.com/objective-see/Malware/raw/main/KoiStealer.zip

github.com

https://t.co/HwSEdu7FVu

t.co

https://twitter.com/Unit42_Intel/status/1904279578127777851?ref_src=twsrc%5Etfw

twitter.com

RustDoor and Koi Stealer for macOS Used by North Korea-Linked Threat Actor to Target the Cryptocurrency Sector Read at the source ↗

unit42.paloaltonetworks.com

The Mac Malware of 2023 Read at the source ↗

objective-see.org

https://github.com/objective-see/Malware/raw/main/Frigid.zip

github.com

https://t.co/djJUx4jPA1

t.co

https://twitter.com/virusbtn/status/1892131771845673380?ref_src=twsrc%5Etfw

twitter.com

https://www.proofpoint.com/us/blog/threat-insight/update-fake-updates-two-new-actors-and-new-mac-malware

proofpoint.com

https://github.com/objective-see/Malware/raw/main/MacSync.zip

github.com

https://twitter.com/moonlock_lab/status/1968010494930981020?ref_src=twsrc%5Etfw

twitter.com

https://www.jamf.com/blog/macsync-stealer-evolution-code-signed-swift-malware-analysis/

jamf.com

https://moonlock.com/macc-stealer-macsync-backdoor

moonlock.com

https://www.reddit.com/r/Malware/comments/1n4wgul/analyzing_macos_infostealer_clickfix_fake/

reddit.com

https://twitter.com/L0Psec/status/2005642384739328468?ref_src=twsrc%5Etfw

twitter.com

https://github.com/objective-see/Malware/raw/main/RNStealer.zip

github.com

https://t.co/kFd2mGP7DM

t.co

https://twitter.com/virusbtn/status/1912070415167463805?ref_src=twsrc%5Etfw

twitter.com

Slow Pisces Targets Developers With Coding Challenges and Introduces New Customized Python Malware Read at the source ↗

unit42.paloaltonetworks.com

https://github.com/objective-see/Malware/raw/main/ChillyHell.zip

github.com

https://www.jamf.com/blog/chillyhell-a-modular-macos-backdoor/

jamf.com

https://t.co/J0LQj2Sq1H

t.co

https://twitter.com/virusbtn/status/1966089611098079728?ref_src=twsrc%5Etfw

twitter.com

https://github.com/objective-see/Malware/raw/main/NightPaw.zip

github.com

https://twitter.com/bruce_k3tta/

twitter.com

https://twitter.com/hashtag/trojan?src=hash&ref_src=twsrc%5Etfw

twitter.com

https://twitter.com/hashtag/macOS?src=hash&ref_src=twsrc%5Etfw

twitter.com

https://t.co/TnOCOvieez

t.co

https://twitter.com/bruce_k3tta/status/1880272316653007218?ref_src=twsrc%5Etfw

twitter.com

https://x.com/moonlock_lab/status/1882441750377296327

x.com

https://denwp.com/fully-undetectable-fud-macos-backdoor/

denwp.com

https://t.co/nsmkngA0Yj

t.co

https://twitter.com/moonlock_lab/status/1882441778999291907?ref_src=twsrc%5Etfw

twitter.com

https://github.com/objective-see/Malware/raw/main/BlueNoroff.zip

github.com

https://x.com/stuartjash

x.com

https://x.com/birchb0y

x.com

https://www.huntress.com/blog/inside-bluenoroff-web3-intrusion-analysis

huntress.com

https://github.com/objective-see/Malware/raw/main/PasivRobber.zip

github.com

https://x.com/AdamJKohler

x.com

https://twitter.com/L0Psec/status/1911776306196267158?ref_src=twsrc%5Etfw

twitter.com

https://the-sequence.com/pasivrobber

the-sequence.com

https://github.com/objective-see/Malware/raw/main/FlexibleFerret.zip

github.com

https://www.sentinelone.com/blog/macos-flexibleferret-further-variants-of-dprk-malware-family-unearthed/

sentinelone.com

https://t.co/6UiveXcEg9

t.co

https://twitter.com/virusbtn/status/1886727793469174080?ref_src=twsrc%5Etfw

twitter.com

https://t.co/TNtI3saO6w

t.co

https://twitter.com/virusbtn/status/1993622008362615272?ref_src=twsrc%5Etfw

twitter.com

https://www.jamf.com/blog/flexibleferret-malware-continues-to-adapt/

jamf.com

https://dmpdump.github.io/posts/NorthKorea_Backdoor_Stealer/

dmpdump.github.io

https://twitter.com/hashtag/DPRK?src=hash&ref_src=twsrc%5Etfw

twitter.com

https://t.co/i6M5Ap3PGe

t.co

https://twitter.com/moonlock_lab/status/1980683916571996312?ref_src=twsrc%5Etfw

twitter.com

https://cyberpress.org/macos-infostealer/

cyberpress.org

https://x.com/g0njxa/

x.com

https://twitter.com/g0njxa/status/1884166667498054004?ref_src=twsrc%5Etfw

twitter.com

https://x.com/MarceloRivero/

x.com

https://twitter.com/hashtag/Odyssey?src=hash&ref_src=twsrc%5Etfw

twitter.com

https://twitter.com/hashtag/Stealer?src=hash&ref_src=twsrc%5Etfw

twitter.com

https://twitter.com/hashtag/AMOS?src=hash&ref_src=twsrc%5Etfw

twitter.com

https://t.co/SqGDYZIS9V

t.co

https://twitter.com/MarceloRivero/status/1888003516859322610?ref_src=twsrc%5Etfw

twitter.com

https://twitter.com/hashtag/backdoor?src=hash&ref_src=twsrc%5Etfw

twitter.com

https://twitter.com/SANSInstitute?ref_src=twsrc%5Etfw

twitter.com

https://twitter.com/BleepinComputer?ref_src=twsrc%5Etfw

twitter.com

https://twitter.com/moonlock_lab/status/1942524364844589264?ref_src=twsrc%5Etfw

twitter.com

https://moonlock.com/amos-backdoor-persistent-access

moonlock.com

https://twitter.com/9to5mac?ref_src=twsrc%5Etfw

twitter.com

https://t.co/fSpTDgtZOg

t.co

https://twitter.com/moonlock_lab/status/1963616720846807052?ref_src=twsrc%5Etfw

twitter.com

https://9to5mac.com/2025/08/27/mosyle-identifies-new-mac-malware-that-evades-detection-through-fake-pdf-conversion-tool/

9to5mac.com

https://www.intego.com/mac-security-blog/intego-discovers-undetected-osx-adload-decompiled-python-adware/

intego.com

https://www.crowdstrike.com/en-us/blog/falcon-prevents-cookie-spider-shamos-delivery-macos/

crowdstrike.com

https://twitter.com/philofishal?ref_src=twsrc%5Etfw

twitter.com

https://twitter.com/dineshdina04?ref_src=twsrc%5Etfw

twitter.com

https://t.co/aZZ80YEH1R

t.co

https://twitter.com/virusbtn/status/1943593984812573097?ref_src=twsrc%5Etfw

twitter.com

https://www.sentinelone.com/blog/macos-zuru-resurfaces-modified-khepri-c2-hides-inside-doctored-termius-app/

sentinelone.com

https://www.patreon.com/bePatron?c=701171

patreon.com

https://t.co/kFGm8tff8v

t.co

https://t.co/ATDCPxBk0u

t.co

https://t.co/bUZSsZCol7

t.co

https://t.co/fOD1R42Dsc

t.co

https://t.co/oyeyMdKPfp

t.co

https://t.co/gAuweiWhrF

t.co

https://t.co/4p04TsYe90

t.co

https://t.co/PhY52v8A7c

t.co

https://t.co/mCg8v0DxoI

t.co

https://t.co/C1Dvw0t8kB

t.co

https://t.co/VoFLKNnoOu

t.co

https://t.co/c9FcotMvYU

t.co

https://t.co/vF6v06YVPT

t.co