Malware research lab @moonlock_com Assembled by @macpaw to detect and study cybersecurity threats.
Joined June 2023
- Tweets651
- Following89
- Followers1.8K
- Likes588
Pinned Tweet
Our team recently published 2026 #macOS malware predictions: supply-chain + AI/workflow (MCP) abuse, signed/notarized stealth & multi-stage loaders, Macs as proxy infrastructure, and “upmarket” infostealers.
Give it a read! 👇
moonlock.com/macos-malware-t…
1/ Yet another finding which we analyzed, this time a VT FUD #macOS Mach-O implant that self-identifies at runtime as "JOCKY agent", shared by @malwrhunterteam.
Here's why nothing caught it statically, explained in a thread below👇
11/ Later, @malwrhunterteam also shared that there is an IP: 172.197.216[.]135 - which does not have any related macOS samples (yet?), but we can clearly see "Jocky" files communicating with it being Win/Linux executables.
1/ Cloning a GitHub repo for a "technical interview" on your #Mac? Check .git/hooks first.
We found a cluster of trojanized repos where post-checkout is a multi-platform dropper for BeaverTail, the DPRK infostealer behind Contagious Interview. 🧵👇
11/ If you've recently cloned a repo for a "take-home task" and your Mac has ~/Library/tokenlinux.sh or ~/.npm/.vscode/parser.js, assume your Keychain and wallets are gone. Rotate everything.
Stay safe 🦫
IOCs 🧙
Stage 0 hooks (SHA-256):
425c425a3ee105c0baef4a97e11716e946dd463fc84c15c78a12b390d0d370f2
b6d6486b596f681ad251172e8ce3fec923208576e625edb7cdd2ad896b92eb39
d84a2c81d20d5929bd63489029f47aade702e311906cc77d8c5d14f3edf06cae
Stage 2 (tokenlinux\.sh):
6629ad2f4018de80f99a45095ce4c9b785b66ed189bb3d73aeee750670088af3
38ab84284d0e72c24c160af910af05544dd2da8757db32ba710b9d19322ecf14
35d8bd637fb0cdd96a14043fa45b0a0cadaf1b99df8a04e556c31fb38a4e194a
Stage 3 (parser\.js):
712cdcb45e5bde3547c4ca620de80132b3af6a22cf743e50574fe7145881d667
f14eebbb2c8f6810fd7d23c20116b6bd1093f2156781a45cd152cc7c9f26939d
6bce36a7aa72ce6542ca57cc57c27896041bf7fdbea24d8ffda82bd6ea824ecf