InfoSecBulletin Cybersecurity for mankind
LockBit ransomware gang is reportedly developing a new version of malware that can encrypt files on Apple macOS, as revealed by MalwareHunterTeam. This would be the first instance of malware targeting Mac devices, as LockBit has previously focused on Linux and Windows devices.
The ransomware group is known for its RaaS (ransomware-as-a-service) operation, lending ransomware to cybercriminals for a fee. The new malware is named locker_Apple_M1_64, and there are separate versions for PowerPC Macs as well.
Apple fixes more than 30 iOS, macOS, and Safari flaws
Attackers exploit critical flaw in Oracle E-Business
WhatsApp to allow usernames instead of phone numbers
Linux Unveils New Open Source Security Project “Akrites” For (OSS) Ecosystem
Data breach affects 14.2 million email logins across six ISPs
Asian Two AI startups launch Mythos-like Model
Polymarket Hack Reportedly Results in $3 Million Theft
Anthropic Confirms US Infrastructure Redeployment of Claude Mythos 5
Hackers Target Cloudflare-Hosted AWS Domains to Steal Console Logins
Daily Cyber security update for 26. 06. 2026
Malware Details:
The new malware, locker_Apple_M1_64, was first detected targeting Mac devices in November 2022, according to Vx-Underground, a platform that examines malware samples. It has not been detected by any anti-malware engines on VirusTotal, but information about this malware has been limited since last fall.
Researchers have noted that the LockBit ransomware gang is expanding its attack spectrum by targeting Macs, which marks a significant development in their tactics.
Expert Analysis:
According to Patrick Wardle, a security researcher and founder of Objective-See, while the malware is capable of running on Macs, it does not pose a serious risk due to several factors. The malware sample analyzed by Wardle was not signed by a trusted certificate, which means macOS won’t run it.
Additionally, Apple’s file system protection solutions such as Transparency, Consent, and Control/TCC would limit the impact of the malware even if it manages to infiltrate a macOS device. Moreover, the malware had bugs, and Wardle concluded that it was not ready for prime time.
In a blog post, Wardle stated that the ransomware is buggy and contains flaws, including buffer overflows that cause it to prematurely exit.
While this may be the first time a large ransomware group created ransomware capable of running on macOS, it is worth noting that this sample is far from ready for prime time […] From its lack of a valid code-signing signature to its ignorance of TCC and other macOS file-system protections as it stands it poses no threat to macOS users.
