Mac users face growing risks as cybercriminals increasingly target both macOS and Windows through coordinated attack campaigns.
Moonlock by MacPaw has published its Mid-2026 macOS Threat Report, providing an in-depth look at the most significant cybersecurity threats affecting Mac users during the first half of 2026. The report highlights a major shift in the threat landscape, showing that attackers are no longer treating macOS and Windows as separate ecosystems.
According to Moonlock’s research, cybercriminals are increasingly running coordinated campaigns that target both operating systems simultaneously. Rather than developing entirely separate attacks, threat actors are using the same infrastructure, domains, operators, and delivery methods while simply deploying platform-specific malware.
One of the report’s most notable findings is that ClickFix remains the most common attack technique. This form of social engineering convinces users to unknowingly execute malicious software themselves, allowing attackers to bypass many traditional security measures.
The report also found that adware accounts for approximately 65% of all detected threats, making it the most prevalent form of malware affecting Mac users. Meanwhile, Odyssey emerged as the leading information-stealing malware family, responsible for 62.7% of stealer detections. The malware is commonly distributed through fake versions of popular applications and services, including Homebrew, TradingView, and LogMeIn.
Artificial intelligence has also become an increasingly popular lure for cybercriminals. Fake AI development tools now rank as the second most impersonated software category, trailing only pirated Adobe Creative Suite installers. As AI adoption continues to grow, attackers are taking advantage of user interest by disguising malware as legitimate AI applications.
Another key finding challenges a common assumption about software safety. More than half of the malicious Mach-O files analyzed in the report were digitally signed, while 22% carried valid or recently revoked Apple Developer certificates. These signatures can make malicious software appear trustworthy and allow it to pass Gatekeeper’s initial verification, underscoring the importance of downloading software only from reputable sources.
The findings reinforce the need for Mac users to remain vigilant as attackers continue to refine their tactics. Social engineering, convincing fake applications, and legitimate-looking code signatures are making malware more difficult to identify than ever before.
The complete Moonlock Mid-2026 macOS Threat Report is available on the Moonlock website and provides additional analysis of current malware trends, attack techniques, and recommendations for staying protected.
