For years, the pitch was simple: Macs don’t get viruses, or at least not the kind that matter. However, anyone who observed Mac security over the past couple of seasons already knows that line doesn’t hold up anymore. The MacPaw research group has prepared a report on MacOS threats by mid-2026. The new Moonlock threat report findings spell out just how far that old assumption has crumbled.
The report isn’t a marketing brochure. It’s a data dump from analysts who spend their days pulling apart malware samples. So, the picture it paints is blunter than most Apple-adjacent headlines you’ll see this summer. Mac and Windows, according to Moonlock, are no longer separate battlegrounds. This shift toward a shared, cross-platform threat surface means attackers are running the exact same campaigns against both systems. They just swap the binary depending on which OS shows up.
Don’t miss the best of The Mac Observer
Set us as a preferred source and our Apple reporting ranks higher in your Google Search results and Discover feed — one tap, no account changes.
The Transition to Other Platforms No One Wanted
Here’s the part that should get your attention if you manage even a handful of Macs. Moonlock’s researchers found campaigns using identical servers, identical domains, and the same operators to hit MacOS and Windows users. It’s not two separate criminal groups anymore. It’s one group with two toolkits. So, it’s a big reason Mac security conversations sound so different this year compared to 2024.
This tracks with what other shops have been saying for a while. Jamf’s Threat Lab flagged similar overlap earlier this year. He pointed to a DPRK-linked operation that shipped seven distinct MacOS malware families in a single campaign. Also, it was running alongside Windows tooling the whole time. For everyday users this shows up in a less abstract way too. General internet security threats advice built around “I’m on a Mac, so I’m fine” is over. Mac threat prevention now needs to be treated with the same seriousness IT teams have long applied to Windows fleets.
ClickFix Still Wins
If you’ve spent any time in Mac forums or security Twitter this year, you’ve run into the term ClickFix. It’s not flashy. There’s no zero-click exploit, no kernel-level trickery. It’s just a fake CAPTCHA or a bogus “fix this error” popup. It walks a user through pasting a command into Terminal themselves. Also, it’s the backbone of most current ClickFix social engineering attacks.
That’s the whole trick, and according to Moonlock it remains the single most common way attackers get onto a Mac. Microsoft’s own Digital Defense Report clocked ClickFix at roughly 47% of observed initial access across 2025. That momentum carried straight into 2026. Instead of standard identity verification pages, lures are increasingly being used. These are disguised as artificial intelligence tools, borrowing the appearance of popular chatbots and programming assistants. Their goal is to trick people into lowering their guard against basic Mac security practices.
Odyssey Stealer Is Having a Moment
If ClickFix is the delivery method, Odyssey is often what’s riding inside. The report names it as the leading example of Odyssey stealer targeting Mac users this cyclePay attention, it’s not spreading through some exotic MacOS zero-day vulnerabilities. Most often, this manifests itself in the following forms:
- pirated Homebrew installations,
- fake TradingView downloads,
- fake LogMeIn updates.
Consequently, these are the same types of enticing offers like “free version of paid software.” As we know, they targeted desktop users for two decades.
Once it’s running, it goes after browser-stored passwords, crypto wallets, and saved credentials. Then it quietly phones home. That’s a textbook case of infostealer malware on Mac. it’s not the adware most people still picture when they imagine a Mac infection. Adware still accounts for the bulk of raw detections, sitting around 65%. However, stealers like this one do real financial damage. That’s also why Mac security budgets are shifting.
Adding to the headache, researchers recently disclosed a MacOS flaw tracked as CVE-2026-39118. It describes a working Kandji and CrowdStrike bypass. The flaw lets a standard, non-admin account quietly disable enterprise endpoint tools. So, it did this without triggering any alerts. Both vendors have since shipped fixes. However, it’s a reminder that even signed, notarized software isn’t immune. Attackers can still talk it out of doing its job.
How Your Own Habits Can Improve Mac Security
Apple has kept up a steady cadence of MacOS Tahoe security updates this year. Also, staying current with Apple security patch timelines is still the least glamorous, most effective thing for Mac security. Beyond patching though, a few habits matter more now than they used to:
- Never paste a command into Terminal because a website told you to, full stop.
- Download software from the developer’s own site or the Mac App Store, not from search ads or “free version” forums.
- Treat AI tool downloads with the same suspicion you’d apply to cracked software.Â
- Keep browser autofill and password managers locked down rather than relying on saved logins in the browser itself.
Healthy habits help keep your device safe. This is a regular practice, not a one-time event.
Main Points of Network-Level Protection
Software hygiene only covers part of the picture. A huge number of Mac-focused IT teams are also tightening up what happens at the network layer. They’re building out proper premium proxy infrastructure. This means routing traffic through dedicated connections, rather than leaving every device exposed. That’s especially true on a flat home or office network.
For teams juggling research accounts or ad verification, this matters even more. The same goes for anyone who wants an extra layer between their devices and the open internet.
Providers that let you buy premium proxies have become a fairly standard part of the toolkit. They sit alongside endpoint protection rather than replacing it. This reinforces overall Mac security rather than substituting for it.
Conclusions
After reading the Moonlock report, we conclude that there is no reason to panic. However, there are clear reasons to reconsider the security of Mac devices.
Some of the trends we highlight include:
- The list of threats has indeed expanded.
- Social engineering methods have become more convincing.
- The “it’s a Mac” security belief has lost its relevance.
Among our initial recommendations, we recommend installing updates immediately. Also, be wary of the Terminal command line. Finally, keep an eye on news and publications like MacObserver.
Discussion