Jamf Threat Labs reported CloudSyncD, a new macOS backdoor that spreads through a fake Zoom installer and beacons to its server every 8 to 16 seconds. First caught as a VirusTotal sample that looked unfinished, it now appears in builds that connect to live infrastructure in what Jamf calls an active campaign.
Perspective Coverage
5 publishers
- Builder
- Builder 25%
- Operator
- Operator 70%
- Investor
- Investor 5%
Reality
- Evidence70
- Adoption15
- Hype gap+15
- Incentives
- Not scored
- Confidence68
Jamf Threat Labs says the Rust macOS stealer pastes itself in via Terminal, fakes an Installer password prompt, mutes the speakers, then hands the operator a headless clone of your logged-in profile.
Perspective Coverage
5 publishers
- Builder
- Builder 30%
- Operator
- Operator 65%
- Investor
- Investor 5%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+10
- Incentives40
- Confidence70
Microsoft Defender Experts tied 30+ domains to a macOS stealer by matching execution, staging and upload behaviour. The count is incidental; the method is the part worth copying.
Perspective Coverage
3 publishers
- Builder
- Builder 28%
- Operator
- Operator 67%
- Investor
- Investor 5%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+10
- Incentives45
- Confidence70
PamStealer now decrypts its macOS payload only through a live handshake with its C2 server
Jamf Threat Labs found a PamStealer build that completes a server key exchange before its macOS payload decrypts, so captured samples cannot be recovered offline. It also layers four persistence methods and a Swift stealer that harvests keychains and credentials from 13 browsers.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence62
Cato Networks says a sponsored ad outranked OpenAI's own page, sending macOS developers to a Google Sites portal whose ClickFix content lives on infrastructure Google never hosted.
Perspective Coverage
3 publishers
- Builder
- Builder 34%
- Operator
- Operator 58%
- Investor
- Investor 8%
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+10
- Incentives35
- Confidence65
Kaspersky says a new MacSync variant hides its payload commands in public iCloud calendar events and downloads the next stage from iCloud. Both the instructions and the download ride trusted Apple domains, past defenses that block known-bad hosts.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap0
- Incentives
- Not scored
- Confidence68
SentinelOne has documented North Korea's Jade Sleet inside a small Indian IT services provider, using Rust backdoors built for Apple Silicon and a Terraform lock file that points developers at a fake HashiCorp registry.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+15
- Incentives40
- Confidence55
A fake macOS toolkit page plants two AMOS payloads in hidden Library folders
Unit 42 followed the copy-paste instructions on Aug. 5, 2026, and watched one Zsh command install AMOS twice over and package a lab Mac's wallet folders and cloud credentials into a single zip.
Reality
- Evidence70
- Adoption30
- Hype gap−10
- Incentives40
- Confidence62
buildOne report1 publisher Three malware campaigns stage their lure pages on Claude and ChatGPT share links
Huntress and BleepingComputer describe sponsored ads that land on a real Claude Artifact page. The download link and the pasted curl command both reach elsewhere, so the trusted hostname never serves the payload.
Reality
- Evidence45
- Adoption35
- Hype gap+15
- Incentives55
- Confidence45
Fake Codex installer outranks OpenAI in Google ads, then asks for a paste
Cato says a sponsored result for "codex macos download" leads to a Google Sites clone whose Terminal command strips quarantine flags and stages an AMOS-linked payload.
Reality
- Evidence58
- Adoption34
- Hype gap+12
- Incentives66
- Confidence57