Mac Malware Volume Grew 40% This Year, and Two Credential Stealers Now Drive Nine in Ten Infections

Macs have spent two decades marketed, and largely accepted, as the platform malware does not bother with. Moonlock Lab's mid-2026 threat report suggests that assumption is being tested at exactly the moment enterprise Mac fleets are at their largest. Unique malicious macOS samples submitted to VirusTotal grew roughly 40% year over year, the count of distinct new malware families nearly doubled, and new backdoor variants alone rose 67% through 2025. None of it required a novel technique. As Moonlock's researchers put it, attackers "didn't invent anything new, they simply got much better at using what already worked."

That framing matters more than any single statistic in the report, because it explains why the numbers keep climbing even though macOS has not developed a new structural weakness. The growth is entirely in execution: better lures, faster distribution, and a small number of malware families scaled far beyond what a single operator used to manage.

A Reassuring Split That Still Hides a Rising Number

Read in isolation, Moonlock's detection breakdown for the first half of 2026 sounds almost comforting. Adware accounts for roughly 65% of detections and potentially unwanted applications for another 25%, leaving stealers, backdoors and trojans combined at under 5% of total volume, split roughly into 1.7% stealers, 1.9% backdoors, 1.2% trojans and 2% riskware. The problem is the base those percentages sit on. When the underlying sample count itself grew 40% in a year, a stable small share of a much larger number is still a larger absolute number of serious infections.

The report also documents a quieter failure in one of macOS's foundational defences. Over half of the malicious Mach-O binaries Moonlock uploaded for analysis were digitally signed, and roughly 20% carried valid or recently revoked Apple Developer certificates. Gatekeeper is built around the assumption that a signed binary has passed some baseline vetting. Attackers who can obtain or abuse a developer certificate get the padlock along with the payload, which is exactly why Mac-specific controls like application allowlisting and continuous compliance checks, rather than code-signing status alone, are what actually catch this.

Two Families Are Doing Most of the Credential Stealing

Within that thin stealer slice, the concentration is stark. Moonlock attributes 62.7% of stealer detections to Odyssey and 29.8% to AMOS, also known as AtomicStealer, meaning a single related lineage accounts for more than nine in ten macOS credential-theft infections. Both are sold as malware-as-a-service, which is a large part of why volume scales faster than the underlying number of distinct threat actors.

The delivery mechanism behind most of that volume is not a software exploit at all. Microsoft's Digital Defense Report, cited in Moonlock's analysis, put ClickFix at 47% of observed initial access across 2025, continuing into 2026, and assessed it will "very likely remain the dominant initial access vector throughout 2026." ClickFix works by presenting a fake error message or verification prompt and walking the user through pasting a command into Terminal themselves, which sidesteps Gatekeeper, code signing and most endpoint controls in one step, because the user did the work.

That matters most downstream of the infection itself. A credential stealer's payoff is not the device, it is whatever the stolen session tokens and saved logins unlock next: cloud consoles, SaaS admin panels, VPN concentrators. Once those credentials are loose, the control that actually limits the damage is not on the Mac at all, it is whatever evaluates the login attempt that follows, weighing device posture and behavioural signals rather than trusting a valid password on its own.

Ransomware Is Still Rare, and Still Getting More Expensive

Ransomware remains the smallest category in Moonlock's breakdown, but it is the one moving fastest in the wrong direction. macOS-targeted ransomware grew more than 20% between 2024 and 2025, and while it still accounts for under 5% of total Mac threat volume, enterprise ransom demands on compromised Mac environments now routinely exceed $50,000, with double-extortion tactics, data theft paired with encryption, increasingly the default. Low frequency and rising severity is a combination that is easy for a fleet with no dedicated Mac ransomware playbook to underweight entirely.

• Stop trusting the padlock. With over half of malicious Mach-O uploads carrying a valid or recently revoked signature, code-signing status alone is not a sufficient gate. Pair it with application allowlisting and continuous compliance checks.
• Train against ClickFix specifically. Generic phishing awareness does not cover a prompt that asks the user to open Terminal and paste a command themselves. That is a distinct pattern and it needs its own module.
• Assume stolen credentials, not stolen devices. Odyssey and AMOS exist to harvest logins and session tokens, not to hold the Mac itself hostage. The response lives in identity and access controls, not endpoint cleanup.
• Make authentication contextual. A valid password from a stolen credential store should not clear the bar alone. Weighing device posture and behavioural signals catches what a static password check cannot.
• Keep a ransomware playbook current even at under 5% share. Frequency is low, severity is not, and $50,000-plus demands with data theft attached are expensive to improvise a response to.
• Budget Mac endpoint coverage like Windows coverage. A 40% year-over-year rise in unique samples is not a rounding error, and fleets that treat Mac as inherently low-risk are sizing their defences against last decade's threat landscape.

Nothing in Moonlock's report describes a platform that has become fundamentally less secure. What it describes is a platform whose attackers finally scaled the operational playbook that has worked against every other OS for years, and an installed base that grew large enough to make that scaling worth their while.