Virus Bulletin 2026 was a treat from start to finish. Our own Kseniia Yamburh unpacked a macOS stealer, shared the stage with a researcher we usually only know by handle, and got to hear that people actually read our research.
Thank you for having us, VB, and thank you, Seville, so glad we got to be part of it: on stage, in the hallways, and as a bronze partner.
Now back to the lab to keep cyber threats away from your Macs.
Thank you for having us, VB, and thank you, Seville, so glad we got to be part of it: on stage, in the hallways, and as a bronze partner.
Now back to the lab to keep cyber threats away from your Macs.
1
2
16
1,231
Mac malware can look surprisingly like a subscription business.
Moonlock Lab sees stealers rented to criminals who run their own campaigns — sometimes for around 1,000–3,000/month.
Updates. Support. Control panels. Even ready-made fake pages.
Attackers don’t always need to Sometimes, they can simply subscribe.
More from Moonlock Lab: moonlock.com/mid-2026-macos…
Moonlock Lab sees stealers rented to criminals who run their own campaigns — sometimes for around 1,000–3,000/month.
Updates. Support. Control panels. Even ready-made fake pages.
Attackers don’t always need to Sometimes, they can simply subscribe.
More from Moonlock Lab: moonlock.com/mid-2026-macos…
0
1
5
215
What can agentic cybersecurity actually do? Forbes asked our @moonlock_lab team.
Mykhailo Pazyniuk’s take: agents take obfuscated malware apart and pull IoCs in minutes, not hours, pivoting to related infrastructure along the way.
Thanks to Ray Fernandez and @Forbes for the feature đź“·
forbes.com/sites/ray-fern…
Mykhailo Pazyniuk’s take: agents take obfuscated malware apart and pull IoCs in minutes, not hours, pivoting to related infrastructure along the way.
Thanks to Ray Fernandez and @Forbes for the feature đź“·
forbes.com/sites/ray-fern…
0
1
2
97
Think someone got into your Gmail?
Start here:
→ change your password
→ check recovery details
→ sign out of unknown devices
→ review recent activity
→ turn on 2FA/passkey
Locked out? Use Google’s official recovery process.
Secure the account first. Investigate : moonlock.com/gmail-hacked
Start here:
→ change your password
→ check recovery details
→ sign out of unknown devices
→ review recent activity
→ turn on 2FA/passkey
Locked out? Use Google’s official recovery process.
Secure the account first. Investigate : moonlock.com/gmail-hacked
1
0
2
130
A delivery message. A PDF attachment. A small fee to reschedule.
Real or fake?
Phishing works because it often looks completely ordinary.
Before clicking, pause for:
→ unexpected attachments
→ urgency
→ payment requests
→ requests for personal info
Real or fake?
Phishing works because it often looks completely ordinary.
Before clicking, pause for:
→ unexpected attachments
→ urgency
→ payment requests
→ requests for personal info
1
0
1
71
Moonlock by MacPaw retweeted
Meet Eney by @MacPaw, a proactive AI assistant for Mac and iPhone.
It flags what actually needs you: the unanswered email, the call you haven’t prepped for, the Downloads folder nobody wants to open. Then it gets the next step ready.
Start with a ready-to-use workflow, or just ip to done with Eney – macpaw.onelink.me/OlF7/x_organic
It flags what actually needs you: the unanswered email, the call you haven’t prepped for, the Downloads folder nobody wants to open. Then it gets the next step ready.
Start with a ready-to-use workflow, or just ip to done with Eney – macpaw.onelink.me/OlF7/x_organic
58
33
116
66,025
That app might not be what it says it is.
Mac malware can hide behind familiar apps, cracked software, fake updates, or normal-looking installers.
The trick isn’t always breaking into your Mac. Sometimes, it’s convincing you to let the wrong app in.
What to watch for: moonlock.com/mac-apps-infos…
Mac malware can hide behind familiar apps, cracked software, fake updates, or normal-looking installers.
The trick isn’t always breaking into your Mac. Sometimes, it’s convincing you to let the wrong app in.
What to watch for: moonlock.com/mac-apps-infos…
0
0
2
76
Not every risky Mac app looks risky.
Malware can hide behind familiar apps, cracked software, fake updates, or normal-looking installers.
A few red flags:
→ unfamiliar download source
→ “right-click to install”
→ paste something into Terminal
→ bypass Mac security
The with the source.
More: moonlock.antimalware.app/game-hub/
Malware can hide behind familiar apps, cracked software, fake updates, or normal-looking installers.
A few red flags:
→ unfamiliar download source
→ “right-click to install”
→ paste something into Terminal
→ bypass Mac security
The with the source.
More: moonlock.antimalware.app/game-hub/
0
0
1
70
For #CybersecurityAwarenessMonth, we’re sharing a series of simple security tips throughout October.
First up: “Macs don’t get malware.”
The threat landscape has changed.
In 2025, Moonlock Lab saw:
↑67% backdoor variants
↑17% stealer variants
And they don’t always look spot the red flags? 👀
Test yourself in the Moonlock Game Hub: moonlock.antimalware.app/game-hub/
First up: “Macs don’t get malware.”
The threat landscape has changed.
In 2025, Moonlock Lab saw:
↑67% backdoor variants
↑17% stealer variants
And they don’t always look spot the red flags? 👀
Test yourself in the Moonlock Game Hub: moonlock.antimalware.app/game-hub/
0
0
2
72
A fake Zoom download can still look a lot like Zoom.
Moonlock Lab @moonlock_lab is tracking Sonoma, a macOS stealer hiding behind familiar names like Zoom, Slack, StreamYard, and Brave Talk.
It can target passwords, browser data, developer secrets, and crypto wallets.
The trick isn’t always a zero-day. Sometimes it’s simply getting you to trust the wrong download.
Here’s what to watch for 👇
hackernoon.com/downloading-zo…
Moonlock Lab @moonlock_lab is tracking Sonoma, a macOS stealer hiding behind familiar names like Zoom, Slack, StreamYard, and Brave Talk.
It can target passwords, browser data, developer secrets, and crypto wallets.
The trick isn’t always a zero-day. Sometimes it’s simply getting you to trust the wrong download.
Here’s what to watch for 👇
hackernoon.com/downloading-zo…
0
0
7
209
Your Mac apps may have access to more of your data than you think.
Apple just patched 150+ flaws in macOS Tahoe 26.7. 18 of them involved ways malicious apps could access user data.
No reported exploitation — but a good reminder to update your Mac and pay attention to what your apps can access.
We broke down what changed 👇
moonlock.com/apple-patches-…
Apple just patched 150+ flaws in macOS Tahoe 26.7. 18 of them involved ways malicious apps could access user data.
No reported exploitation — but a good reminder to update your Mac and pay attention to what your apps can access.
We broke down what changed 👇
moonlock.com/apple-patches-…
0
0
2
136
For SMBs, the attack surface is bigger than a list of devices.
Cloud accounts, websites, company Macs, and employee devices are all part of the same connected target.
Our Mykhailo Pazyniuk @xor3r shared his perspective with @Forbes on how SMBs can strengthen that surface as AI reshapes cybersecurity.
Thanks to Ray Fernandez for including Moonlock’s expertise in the piece.
🔗 forbes.com/sites/ray-fern…
Cloud accounts, websites, company Macs, and employee devices are all part of the same connected target.
Our Mykhailo Pazyniuk @xor3r shared his perspective with @Forbes on how SMBs can strengthen that surface as AI reshapes cybersecurity.
Thanks to Ray Fernandez for including Moonlock’s expertise in the piece.
🔗 forbes.com/sites/ray-fern…
0
0
2
82
Moonlock by MacPaw just won a Red Dot Award 2026 in the Interface & User Experience Design category.
Great design makes even complex things feel simple, and we're happy to see that approach recognized.
From day one, we designed Moonlock to make Mac protection clear, apprse. An intuitive interface, plain-spoken copy, thoughtful interactions, and hand-drawn illustrations all work together to make cybersecurity feel more human.
Good design isn't just about how a product looks. It's about how easily people understand it, trust it, and make it part of their everyday lives.
We’re incredibly proud of the team behind Moonlock — and happy to see their work recognized by Red Dot ❤️
Great design makes even complex things feel simple, and we're happy to see that approach recognized.
From day one, we designed Moonlock to make Mac protection clear, apprse. An intuitive interface, plain-spoken copy, thoughtful interactions, and hand-drawn illustrations all work together to make cybersecurity feel more human.
Good design isn't just about how a product looks. It's about how easily people understand it, trust it, and make it part of their everyday lives.
We’re incredibly proud of the team behind Moonlock — and happy to see their work recognized by Red Dot ❤️
1
1
5
956
Most WhatsApp hacks don’t start with someone “breaking” encryption.
They start with something much simpler:
a verification code, a QR scan, or one convincing link.
Here’s how WhatsApp accounts actually get compromised — and how to spot it before it happens.
moonlock.com/whatsapp-hacked
They start with something much simpler:
a verification code, a QR scan, or one convincing link.
Here’s how WhatsApp accounts actually get compromised — and how to spot it before it happens.
moonlock.com/whatsapp-hacked
0
0
1
108
A fake macOS update that takes over your entire screen, then asks you to paste a "verification code" into Terminal.
Real macOS updates have never asked for that. Not once. Not ever.
$890K gone across 281 transfers so far.
moonlock.com/fake-macos-upd…
Real macOS updates have never asked for that. Not once. Not ever.
$890K gone across 281 transfers so far.
moonlock.com/fake-macos-upd…
0
3
16
1,417
Our mid-2026 macOS Threat Report got a closer look from @MacObserver đź‘€
The takeaway? Mac threats are getting trickier — and the old “Macs don’t get malware” mindset is increasingly out of date.
From ClickFix attacks to cross-platform campaigns and infostealers, see what’s shaping the macOS threat landscape in 2026.
Read @MacObserver take 👇
macobserver.com/macos/mac-secu…
The takeaway? Mac threats are getting trickier — and the old “Macs don’t get malware” mindset is increasingly out of date.
From ClickFix attacks to cross-platform campaigns and infostealers, see what’s shaping the macOS threat landscape in 2026.
Read @MacObserver take 👇
macobserver.com/macos/mac-secu…
1
0
4
305
Want to go deeper? 🔎
Explore the full Moonlock Lab mid-2026 macOS Threat Report, including threat data, attack trends, and recommendations for Mac users and security teams:
moonlock.com/mid-2026-macos…
Explore the full Moonlock Lab mid-2026 macOS Threat Report, including threat data, attack trends, and recommendations for Mac users and security teams:
moonlock.com/mid-2026-macos…
0
6
26
6,672