Loading story…
SentinelLabs reported on macOS.GMERA, a malware family targeting Apple systems, and detailed how its activity can be identified through behavioral inspection rather than relying solely on static signatures. The reporting highlights GMERA as a macOS threat whose execution leaves observable traces that defenders can use to detect malicious behavior on infected endpoints.
The coverage emphasizes endpoint monitoring for suspicious process behavior and related system activity to improve detection of GMERA on macOS devices. By focusing on runtime behaviors instead of file-based indicators alone, defenders can better identify variants and evasive samples that may bypass traditional signature-based controls.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
SentinelLabs published research describing how to detect the macOS.GMERA malware through behavioral inspection. The two provided references are duplicate publications of the same report on SentinelOne-owned domains.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are increasingly using weaponized `.dmg` files disguised as legitimate macOS software installers to deliver infostealer malware, with campaigns relying heavily on social engineering to convince users to bypass Apple Gatekeeper and other trust prompts. Researchers said the malware typically focuses on rapid collection and exfiltration rather than persistence, stealing browser credentials, cookies, authentication tokens, Apple Keychain data, macOS passwords, and cryptocurrency wallet information from infected systems. Multiple macOS stealer families have been tied to the tactic, including **Atomic macOS Stealer (AMOS)**, Poseidon, Odyssey, and MacSync. AMOS in particular has been marketed as malware-as-a-service and distributed through malvertising, SEO poisoning, fake download pages, social media ads, GitHub-hosted binaries, open directories, poisoned search results, and piracy forums while impersonating popular apps such as Notion, Trello, Arc, Slack, Todoist, and CleanMyMac X. Defenders were urged to monitor suspicious DMG mount activity in `/Volumes`, inspect hidden `.background` directories, use OCR on installer graphics, unmount suspicious disk images quickly, and restrict software installation to legitimate, Apple-verified sources outside unofficial or cracked-software channels.
Jun 29, 2026
Check Point Research reported that **Formbook**, a malware family long associated with Windows infections, evolved to operate in **macOS** environments while retaining many of the evasion and collection techniques that made it effective on other platforms. The research describes a cross-platform shift in which operators adapted established tradecraft to Apple systems, signaling that commodity malware developers are increasingly treating macOS as a viable target rather than a niche platform. The report highlights how the macOS variant reused **time-tested tactics** from earlier Formbook activity, indicating continuity in operator behavior even as the malware moved into a new operating system. For defenders, the development underscores the need to extend endpoint monitoring, malware detection, and user awareness controls to macOS fleets, especially against infostealer-style threats that can leverage familiar social engineering and stealth mechanisms in a different environment.
Jul 12, 2026
Researchers reported multiple campaigns distributing macOS infostealers tied to the **AMOS/AtomicStealer** ecosystem, a malware-as-a-service operation that steals credentials, browser data, cryptocurrency wallets, Apple Notes, files, and **Keychain** material from macOS Catalina and newer systems on Intel, M1, and M2 devices. Earlier reporting on related macOS stealers showed operators relying on social engineering, unsigned DMG files, and password prompts to collect sensitive data, package it into archives, and exfiltrate it to command-and-control servers, with some activity also summarized to Telegram channels. More recent campaigns used **malvertising** and fake software or troubleshooting pages to lure users into running Terminal commands that fetched an AMOS variant known as **"malext"**. Investigators said the malware used obfuscated shell commands, `osascript`, quarantine removal, anti-VM and sandbox checks, and in some cases installed persistence through a LaunchDaemon and helper scripts, while also trojanizing Ledger and Trezor applications and capturing administrator passwords. Reporting also linked AMOS delivery to fake **CleanMyMac** sites and AI-themed lures, indicating operators are rapidly rotating ad accounts and adapting infection vectors to broaden theft and remote access on macOS systems.
Jun 29, 2026