Hackers are distributing macOS malware that masquerades as legitimate software updates from Apple, Google, and Microsoft to steal user passwords [1].

This campaign is significant because it targets the trust users place in system updates to compromise security. By impersonating three of the most ubiquitous software providers, attackers increase the likelihood that users will grant the malware permission to execute on their devices.

The malware is designed to trick Mac users into installing fraudulent updates [1]. Once installed, the software targets stored passwords and attempts to bypass two-factor authentication protocols [1]. This allows attackers to gain unauthorized access to sensitive accounts even when secondary security layers are active.

Reports indicate the scam employs various lures to deceive victims. Some versions of the attack present the malicious software as an update for Microsoft Teams [1]. Other iterations use the branding of Apple and Google to convince users that their systems require urgent maintenance or security patches [1].

Security researchers said that the malware specifically targets the macOS environment [1]. The goal is to harvest credentials that can be sold on the dark web or used for further corporate espionage. Because the malware mimics official communication styles from tech giants, it can often evade the suspicion of non-technical users.

Experts said that users should only download updates through official system settings or verified app stores. Avoiding third-party prompts for software updates is a primary defense against this specific password-stealing campaign [1].

“Hackers are distributing macOS malware that masquerades as legitimate software updates”

This trend highlights a shift toward high-trust social engineering, where attackers no longer rely on obscure phishing sites but instead mimic the core update mechanisms of operating systems. By targeting macOS, hackers are exploiting a perceived security gap in a platform often viewed as more secure than Windows, potentially leading to a higher success rate in credential theft.