⚡ 25,000 U.S. businesses already use macOS, and the number keeps growing. Yet macOS threats are still flying under the radar for most security teams.

Attackers know this. 👀 And they're quietly adding more cross-platform threats to take advantage of it, targeting sensitive data.

That's exactly why #ANYRUN just levelled up. The sandbox now supports #macOS alongside #Windows, #Linux, and #Android — one unified place, full visibility, faster verdicts.

👉 Close the gap before it becomes a costly one: https://thn.news/mac-threat-analysis

⚠️ WARNING - Are you using #ChatGPT, Codex, or OpenAI Atlas browser?

Update now... Older #macOS apps will stop working after May 8, 2026 due to a supply chain attack on a dependency used in OpenAI’s signing workflow. No user data was compromised, but certificates are revoked.

🔗Read → https://thehackernews.com/2026/04/openai-revokes-macos-app-certificate.html

macOS attacks are now hiding in system features.

Payloads stored in Spotlight metadata let attackers run code without suspicious files, using native scripting and protocols to move and persist outside standard monitoring.

🔗 Learn how macOS built-ins are being weaponized → https://thehackernews.com/2026/04/threatsday-bulletin-290m-defi-hack.html#macos-stealth-execution-abuse

🛑 Google and YouTube ads are delivering FlutterShell, a new #macOS backdoor that passed Apple notarization with valid Developer IDs.

The malware can hijack Chrome traffic, run shell commands, alter files, and update its behavior from attacker servers.

Read: https://thehackernews.com/2026/06/fluttershell-backdoor-spreads-to-macos.html

This week’s cyber recap is stacked:

🌐 Chrome 0-day exploited
🏛️ Oracle PeopleSoft hit
🐧 Arch AUR packages poisoned
🔐 Check Point VPN attacks
📡 UniFi flaws exploited
🎣 Major phishing kit takedown
🤖 AI brands used as bait
🍎 #macOS fake installers
📦 npm/PyPI malware
📱 #Android adware
☁️ Cloud logging abuse risks
🕵️ RAT using Google Sheets
💾 Ransomware data exfil tricks

Plus urgent CVEs, tools, and expert webinars.

Read here: https://thehackernews.com/2026/06/weekly-recap-chrome-0-day-unifi.html

> A clean-looking GitHub repo.
> A poisoned npm package.
> A new cross-platform RAT.

Researchers found SStar Agent targeting Windows and #macOS through a fake Web3 developer take-home test.

Windows builds add keylogging, clipboard monitoring, and remote control. macOS builds focus on recon and data theft.

Read: https://thehackernews.com/2026/06/threatsday-bulletin-worm-code-leaked-ai.html#cross-platform-rat-emerges

🚨 Malware is now trying to confuse the AI tools used to analyze it.

Experts found Gaslight, a Rust-based #macOS implant linked to North Korea-aligned actors.

It embeds fake system messages to push AI-assisted triage toward aborting or refusing analysis.

See how it works: https://thehackernews.com/2026/06/new-gaslight-macos-malware-uses-prompt.html

🛑 Gaslight doesn’t just steal from #macOS.

It tries to talk the analyst’s AI tools out of analyzing it.

SentinelOne found a Rust-based implant with #Telegram C2 and 38 fake “system” messages built to make LLM-assisted triage abort or refuse.

Read: https://thehackernews.com/2026/06/new-gaslight-macos-malware-uses-prompt.html

⚠️ New Java RAT is being sold as MaaS.

QuimaRAT is built to run on Windows, #Linux, and #macOS, with encrypted plugins, OS-specific persistence, C2 rotation via Pastebin, and a browser-cache loader for staging payloads.

Read: https://thehackernews.com/2026/07/new-java-based-quimarat-maas-built-to.html

🚨 Alibaba tool users were targeted with a cross-platform RAT.

Researchers linked 18 malicious npm packages to a layered dependency chain that served Windows, #Linux, and #macOS payloads with command execution, persistence, file transfer, and lateral movement capabilities.

How the npm attack worked: https://thehackernews.com/2026/08/18-malicious-npm-packages-deliver-cross.html