macOS malware and security vulnerabilities

In early July 2026, Jamf Threat Labs identified a social‑media campaign that used sponsored X posts to impersonate the macOS utility DynamicLake. The ads directed users to a counterfeit site that prompted a Terminal command, installing the “MacSync” variant of the Atomic Stealer malware, which harvests passwords, cookies and cryptocurrency wallet files.

Later that month, researchers disclosed a macOS Gatekeeper design flaw that lets a previously verified application bundle be silently replaced with a malicious version after the initial code‑signing check. Demonstrations showed replacements of Signal, Brave, Slack and VS Code, with the vulnerability affecting non‑Mac App Store apps and requiring only user‑level access.

Apple classified the behavior as non‑fixable and closed the case without a patch, urging users to keep macOS and apps up‑to‑date and to favor App Store software. In parallel, Apple announced macOS 27 “Golden Gate,” a new XProtect‑based sandbox extension that protects specific Application‑Support directories used by browsers, cryptocurrency wallets and other apps, preventing unauthorized terminal access and allowing dynamic addition of protected locations. The combined incidents highlight a growing macOS threat landscape that blends social engineering, systemic verification gaps, and evolving platform defenses.