Experts from the BI.ZONE Threat Intelligence unit, following an analysis of dark web marketplaces, have recorded a multiple-fold increase in offers for macOS malware. During the first nine months of 2026, the number of listings for Apple platform malware increased sixfold compared to the same period in 2025. Comparing current figures with data from 2023–2024, the growth represents more than a third of the previous volume. Previously, such programs were sold in limited batches with noticeable gaps, whereas in 2026 new listings appear almost monthly, indicating a market transition from sporadic activity to a steady flow of offers.
Price Range and Offer Structure
The cost of tools on the shadow market ranges from $70 for basic utilities to $20,000 for comprehensive solutions. According to researchers, the most expensive items are not the malware modules themselves, but accompanying services: digital signing and notarization services for applications to bypass Apple's built-in security mechanisms are priced by sellers at up to $1,500 per operation. This allows attackers to present malicious code as a legitimate, Gatekeeper-verified application, significantly reducing the likelihood of it being blocked during installation.
Shifting Vector: From Stealers to Management Infrastructure
The composition of the offered arsenal has also changed qualitatively. While previous years were dominated by specialized programs for stealing browser data and crypto wallets, 2026 has seen remote access trojans (RATs) and command and control (C2) platforms come to the fore. This transition to infrastructural solutions means attackers are seeking not just one-time data theft, but long-term presence in the compromised system with remote management capabilities, lateral movement, and privilege escalation. Ready-to-use C2 frameworks, enabling coordinated actions across multiple infected nodes simultaneously, have become a distinct market sector.
Distribution Methods and Claimed Technical Characteristics
Social engineering is actively used to deliver the malicious code: users are persuaded to manually run commands in the terminal or open prepared files, bypassing standard protection mechanisms. Sellers claim in their listings support for Apple Silicon processors, the use of the Rust language in the malware architecture, and advanced code obfuscation methods. However, BI.ZONE emphasizes that verifying these characteristics without access to actual program samples is impossible, and some claims may be of a marketing nature aimed at increasing the perceived value of the offer.
Corporate Risks and Outlook Assessment
According to BI.ZONE analysts, macOS is gradually ceasing to be a niche and “rare” target for cybercriminals. The compromise of a single work computer on the Apple platform can open access not only to personal user data, but also to SSH connections, cloud service credentials, and the settings and configurations of AI tools integrated into corporate infrastructure. Amidst the mass corporate shift to hybrid work models and the active adoption of generative AI in workflows, each employee's Mac laptop becomes a potential access node to critical corporate resources, multiplying the cost of a successful attack and the attackers' motivation to master the platform.
