logo

Hackers Hijack YouTube and Fake Wallpaper App To Unleash notnullOSX Malware Onslaught

ID: 2d3475ae-cab6-5332-85ba-2440c18bd86a

STIX ID: report--2d3475ae-cab6-5332-85ba-2440c18bd86a

Feed Name: Cyber Press

Threat Score
72/100

Date Published: 2026-04-23

Date Updated: 2026-04-23

Author: Varshini

...
...

notnullOSX is a modular Go-based macOS infostealer distributed through a polished fake "WallSpace" wallpaper site, a malicious DMG, and a hijacked YouTube channel; attackers use social engineering to coerce Full Disk Access and selectively target crypto holders (≥$10,000), harvesting browser credentials, cookies, messaging data, SSH keys, and crypto wallet files and using persistence and C2 for exfiltration (early detections in Vietnam, Taiwan, and Spain).

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.