notnullOSX Malware Targets Mac Users With Crypto Wallets

Steady attention without excessive speculation.

The campaign is not random. According to Moonlock, the operators hand-pick targets who hold more than $10,000 in crypto. Then they trick victims into installing the malware by hand.

How the notnullOSX Malware Infects a Mac

The attack starts with social engineering, not a software exploit. First, the victim meets one of two lures. Both lead to the same payload.

One path is ClickFix. Here the victim sees a fake error and pastes a base64 command into Terminal. The other path is a malicious DMG that poses as a wallpaper app called WallSpace, promoted through a hijacked YouTube channel.

After the victim runs either lure, a bash installer fetches the main binary. That file is a multi-architecture Mach-O, obfuscated with garble, and weighs about 27 MB. Moonlock first spotted the campaign in the wild on March 30, 2026, with early hits in Vietnam, Taiwan, and Spain.

Next comes the critical step. The malware convinces the user to grant Full Disk Access. As a result, it bypasses Apple’s TCC privacy controls and reaches protected files. You can read the full technical breakdown in the Moonlock Lab report.

A Fake Google Doc and a Terminal Trick

The standout lure is a fake protected Google document. When the victim opens it, the page shows an encryption error. It blames the problem on an outdated “Google API Connector.”

Then the document offers a fix. In reality, that fix runs the installer. The lure was first reported by researcher @g0njxa on X, according to Moonlock.

This approach works because it turns the user into the attacker’s tool. Instead of breaking macOS defenses, the operators simply ask the victim to switch them off. So the infection looks like routine troubleshooting.

Modules Built to Drain Crypto Wallets

Once installed, notnullOSX pulls modular components on demand. Each module runs from the /tmp folder and handles one job. The operators load only what they need for each target.

The lineup is broad. For example, CredsGrab collects saved passwords, while BrowserGrab targets browser data. CryptoWalletsGrab hunts wallet files, and Moonlock notes more than 30 wallet extension IDs on the target list.

Other modules reach further. AppleNotesGrab extracts and decompresses the Apple Notes database. TelegramGrab copies the entire tdata session folder. Because that folder holds a live session token, attackers can restore the account elsewhere and skip both the password and two-factor checks.

Finally, the malware sends everything out. It uses a persistent, WebSocket-style channel to a Firebase Realtime Database that serves as the command server. A LaunchAgent keeps the infection alive across reboots. In short, the notnullOSX malware behaves like a remote control toolkit rather than a single smash-and-grab.

Why Cold Storage Does Not Make You Safe

The most dangerous module is ReplaceApp. On command, it swaps a real wallet app for a trojanized clone while keeping the original icon. So the fake Ledger Live or Trezor Suite looks identical on the dock.

The trap springs at the next launch. When the user opens the swapped app and enters a seed phrase during setup or recovery, the clone captures it. After that, the attacker controls the funds.

This matters even for hardware wallet owners. Cold storage protects keys at rest, yet it does not protect the moment a user types a seed phrase into a companion app. The notnullOSX malware targets exactly that weak point. That is also why the operators focus on wallets worth more than $10,000, since the payoff justifies the manual effort.

Who Is Behind notnullOSX

Moonlock ties the tool to a developer who uses the alias alh1mik. That handle reportedly links back to 0xFFF, an actor banned from the XSS forum around 2022 to 2023.

According to the report, the developer resurfaced as alh1mik in August 2024 and pitched a new macOS stealer. That project appears to have become notnullOSX in early 2026. Still, attribution beyond the alias remains unclear.

The threat fits a wider trend. Since 2022, families like Atomic Stealer have pushed macOS crypto theft forward. More recently, researchers flagged MacSync Stealer, SHub, and PamStealer, so the notnullOSX malware joins a crowded and active field.

How to Protect Your Mac From notnullOSX

The core defense is simple. Never paste a Terminal command you do not understand, and never grant Full Disk Access to fix a strange error.

Beyond that, treat seed phrase prompts with suspicion. If a wallet app suddenly asks you to re-enter your recovery phrase, stop and verify the app first. Because the clone keeps the real icon, the request itself is the clearest warning sign.

The campaign remains active as of mid-2026, so Mac users with meaningful crypto should stay alert. As always, this is not financial advice, but the safest move is to slow down before you click, paste, or approve.