MacPaw’s Moonlock Lab has investigated the origins, functionality, and distribution of notnullOSX, a new Go-based modular stealer with full backdoor capabilities. The Lab’s telemetry recorded the first detections of notnullOSX on March 30, 2026. Delivered via ClickFix and malicious DMG files, notnullOSX is built exclusively to drain crypto holdings above $10,000 from macOS users. It […]
