Related Threat Clusters
-
North Korean Sapphire Sleet Targets macOS Users in New Social Engineering Campaign
A North Korean cybercrime group known as Sapphire Sleet has launched a social engineering campaign targeting macOS users, as reported by Microsoft's Threat Intelligence unit. The campaign involves tricking users into…
7 articles · Updated April 17, 2026 -
XCSSET Malware Evolves with Enhanced Obfuscation and Persistence Techniques
The XCSSET malware has released a new variant, v40, targeting macOS systems and specifically infecting Xcode projects. This version employs advanced obfuscation techniques, including polymorphic payload generation and…
3 articles · Updated September 9, 2026 -
XCSSET Malware Targets macOS Developers Through Xcode Projects
The ADEX security team has published a case study on an active XCSSET malware infection affecting an iOS app development studio. XCSSET, a modular macOS malware identified in 2020, embeds itself in Xcode project files…
5 articles · Updated May 19, 2026 -
InstallFix Campaign Exploits AI Trust to Deliver Malware via Fake Install Pages
The InstallFix campaign targets users by creating fake installation pages for Anthropic's Claude AI, tricking them into executing malware. This sophisticated social engineering tactic exploits the growing reliance on AI…
53 articles · Updated May 5, 2026 -
Bybit Exposes Multi-Stage Malware Targeting Claude Code Users
Bybit's Security Operations Center (SOC) reported a sophisticated malware campaign targeting macOS users searching for 'Claude Code,' an AI development tool from Anthropic. The campaign, first identified in March 2026,…
5 articles · Updated April 21, 2026 -
MacSync Infostealer Exploits Google Search for Claude Installation
A malvertising campaign has emerged, using Google search results for Claude installation to deliver a macOS infostealer named MacSync. Victims are misled to a legitimate claude.ai shared conversation page, where they…
2 articles · Updated August 19, 2026 -
MioLab MacOS Stealer Targets Users with Advanced Theft Techniques
MioLab, a sophisticated MacOS infostealer, has emerged as a significant threat in the cybercrime landscape, particularly targeting both consumer and enterprise users of Apple's macOS. Marketed on Russian-language forums…
3 articles · Updated March 23, 2026 -
MacSync Stealer Exploits ClickFix Lures to Target macOS Users
The MacSync Stealer is a malware-as-a-service targeting macOS users through ClickFix social engineering lures. Attackers trick victims into executing malicious Terminal commands, bypassing traditional security measures.…
2 articles · Updated September 10, 2026 -
Exploitation of macOS Native Tools for Stealthy Attacks on Enterprises
Recent research by Cisco Talos reveals that attackers are increasingly leveraging native macOS features to execute code and move laterally within enterprise environments. With over 45% of organizations now using macOS,…
2 articles · Updated April 22, 2026 -
Malware Campaign Targets Open VSX Extension with 5,066 Downloads
A sophisticated malware campaign has compromised the Open VSX extension marketplace, affecting over 5,000 developer workstations. The malicious package masqueraded as a legitimate Angular Language Service extension,…
20 articles · Updated January 30, 2026
Recent Intelligence Reports
- MacSync Stealer Uses ClickFix and Chunked Exfiltration — Socprime · September 9, 2026
- September 2025 — www.microsoft.com · September 9, 2026
- New Xcsset Malware Adds New Obfuscation Persistence Techniques To Infect Xcode Projects — www.microsoft.com · September 9, 2026
- Xcsset V40 Malware Analysis — unit42.paloaltonetworks.com · September 9, 2026
- MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer — Huntress · August 17, 2026
- Tracker — www.globenewswire.com · June 1, 2026
- Adex Publishes Analysis Of Xcsset Malware Research Details How Active Infection Spreads Silently Through Xcode Projects Github Repositories And Developer Credentials 302775907 — www.prnewswire.com · May 19, 2026
- ADEX Publishes Analysis of XCSSET Malware: Research Details How Active Infection ... — Morningstar · May 19, 2026