Moonlock Lab

This account is verified. Learn more

@moonlock_lab

Malware research lab @moonlock_com
Assembled by @macpaw to detect and study cybersecurity threats.

moonlock.com/moonlock-lab Joined June 2023

89 Following 1.8K Followers 651 Posts

Latest posts 5

Pinned post

Moonlock Lab @moonlock_lab Feb 5

Our team recently published 2026 #macOS malware predictions: supply-chain + AI/workflow (MCP) abuse, signed/notarized stealth & multi-stage loaders, Macs as proxy infrastructure, and “upmarket” infostealers.
Give it a read! 👇
moonlock.com/macos-malware-…

moonlock.com 6 trends in macOS malware Here's what to watch out for in 2026.

Moonlock Lab @moonlock_lab Oct 29

1/ Yet another finding which we analyzed, this time a VT FUD #macOS Mach-O implant that self-identifies at runtime as "JOCKY agent", shared by @malwrhunterteam.
Here's why nothing caught it statically, explained in a thread below👇

Moonlock Lab @moonlock_lab Oct 28

1/ Cloning a GitHub repo for a "technical interview" on your #Mac? Check .git/hooks first.
We found a cluster of trojanized repos where post-checkout is a multi-platform dropper for BeaverTail, the DPRK infostealer behind Contagious Interview. 🧵👇

Moonlock Lab @moonlock_lab Oct 22

1/ We tore apart a #macOS C2 implant that's currently sailing past engines on VT - 0 detections as of today. Shared by @malwrhunterteam.
Written in Zig, and engineered like red-team infrastructure.
Here's what makes it interesting 👇

Moonlock Lab @moonlock_lab Oct 12

1/ New #macOS #malware, seems FUD for now, shared by @malwrhunterteam.
A hidden-VNC (hVNC) implant that doesn't mirror your screen. It secretly clones your browser profile and drives a ghost copy of Chrome/Firefox with your live logins. Decided to track it as GhostProfile 👇