Moonlock Lab

Malware research lab @moonlock_com
Assembled by @macpaw to detect and study cybersecurity threats.

[Moonlock Lab @moonlock_lab]

Our team recently published 2026 #macOS malware predictions: supply-chain + AI/workflow (MCP) abuse, signed/notarized stealth & multi-stage loaders, Macs as proxy infrastructure, and “upmarket” infostealers.
Give it a read! 👇
https://t.co/GE2r8klkqw

[Moonlock Lab @moonlock_lab]

@500mk500 Thanks, missed out on this post.
Strange how it stayed under the (static) radar despite being plaintext with some strong signals.

[Moonlock Lab @moonlock_lab]

1/ New #macOS bash dropper - 0 hits on VT. Shared by @malwrhunterteam.

Self-deletes on launch. Delivers a binary from weekly-up[.]online while pushing a fake Zoom, Teams, or SystemApp as cover.
Might be related to Contagious Interview, however no strong confirmation yet. 🧵

[Moonlock Lab @moonlock_lab]

@blackbigswan Thanks for sharing this info, it's very valuable!
Yes, we are not 100% sure it is DPRK-related as well, so not making any statements yet .. just that the approach is similar.

[Moonlock Lab @moonlock_lab]

IOCs 🧙

weekly-up[.]online
• /2?type=sh → payload
• /2?topic=zoom|teams|system → decoys
163e4a72cbe392c073eddc60aee69dc1cf87ce492c375af74e923d75d8084683

Dropped: TMPDIR/<random>.bin

[Moonlock Lab @moonlock_lab]

5/ While the decoy app loads, winapp_fork_bins() fires two curl processes in the background, pulling the real payload from weekly-up[.]online/2?type=sh into TMPDIR under a randomly-generated name.
The loop runs indefinitely, and filename is runtime-random.

[Moonlock Lab @moonlock_lab]

@suyog41 Thanks for sharing!
Looks like a MacSync variant (likely).

[Moonlock Lab @moonlock_lab]

As correctly mentioned by @malwrhunterteam, also related:
botambus228[.]com

[Moonlock Lab @moonlock_lab]

1/ Looks like #DigitStealer is still hard to detect on VT. @malwrhunterteam shared a file with us which led to Stage-1 compiled AppleScript. With multiple parallel scripts to execute, it remains a threat to #macOS users.
More info below 👇

[Moonlock Lab @moonlock_lab]

IOCs 🧙
36921e0b92dbd51e339b1b2e18f8fa6c8c9a5ca085db36a8cd14a37ac99733de
2szh5rey2kli8568t52fwgzqqtqbtx3ftchkskvp1h1lgiahu6ja8mozs8[.]pages[.]dev
/1fBH4tuWLfE0XC0azIJt9tJOPF0qZTJu5W7UePpFjODuJdVwafw9oWF5vfzUKjts263eKSz1ZwUDq.aspx
/eqXPuS5US2lC55JVK6vn36rmIAkYKUHIewSXLeLgTXnDKKe3Xp4N43SP18UDmTP5r.aspx
/d6sVG2qTsywy8qtINYuCNBKotbK87J1TXXiMIw5lvcQX9Z2y4SSu6Z0PEzdDfVJkHzwrtxMs.aspx
/Xtjjr3mv5O77uXAwkE7iCPrilHTCPUfvXghi4nScGHLtqKDxzPuyTRe814G7I7yWdtuGWDNF.aspx
/kEtHswrx0bn9fxKMlRqrjedf86HJUtJv4ILtxfKeYzPS7gh0cBgGYl5JttZWlQ2SB9wdv.aspx
/NWqIcb9gEHRjDgB1y9n1pLV87fzJDIYd0pInHSKcQp8u9LbTe9bnXOn5ZVJJqB0ru2N5OkKQlSyB85.aspx
/15RculaClIl7TomcP34u8eCkhrJZtW5opxIrpV7oZSlh63IEHMYsRJo8ZaCX1zv3QihA.aspx
/Quj6lrBqAXYgJt4ymRSasnSccZfT7i6wn0Z4UNbqqPZJa0Rb4TDJqGKevsZ7fbGPln.aspx

[Moonlock Lab @moonlock_lab]

cc @500mk500 (for network IOCs)

[Moonlock Lab @moonlock_lab]

A recent surge in the #Odyssey stealer on #macOS has hit 100+ countries.

What this variant does:
- Harvests passwords, cookies & autofill from Chrome, Brave, Edge, Vivaldi, Opera, Arc, Firefox/Waterfox
- Steals wallet files from 16+ crypto apps (Electrum, Exodus, Ledger Live, Trezor Suite, Bitcoin/LTC/Dash Core, Monero...) + targets ~300 crypto extension IDs
- Grabs SSH keys, AWS/GCP/Azure/Docker configs, FileZilla logins, Keychain DB, Telegram/Discord data, zsh history + local password via dscl
- Installs a persistent LaunchDaemon + swaps Ledger/Trezor/Exodus apps for trojanized "drainer" versions

🛜 C2: 165[.]245.215.18 (primary) → rahtam[.]com (fallback) → scubin[.]com (2nd-stage + trojan wallet payloads)

🛡️ Always verify app sources before installing!

[Moonlock Lab @moonlock_lab]

cc @patrickwardle @g0njxa @malwrhunterteam @arinwaichulis @philofishal @shablolForce @txhaflaire @theevilbit @L0Psec @theJoshMeister @bruce_k3tta @birchb0y @AndreGironda @suyog41 @NietzscheLab @SEAL_911 @_SEAL_Org @malwarezoo

[Moonlock Lab @moonlock_lab]

1/ New #macOS (crossplatform) sample: a full-featured remote access trojan masquerading as MicrosoftSystem64 and using #huggingface legitimate infrastructure for its C2 activities. JavaScript payload + RAT inside a Mach-O binary. Findings below 👇

[Moonlock Lab @moonlock_lab]

IOCs:
f981d0470ff0c7afafe2d08e91a55c1e7a5bb35ca28803bbd349ec753789ce4f
195.201.194[.]107:8010
~/Library/LaunchAgents/com.launchkeeper.MicrosoftSystem64.plist
https[://]huggingface[.]co/jpeek998/system-releases/resolve/main/MicrosoftSystem64-darwin-arm64