English HomeApple NewsTech NewsArabic Home
Rumor

Mosyle identifies two new macOS threats invisible to antivirus engines

9to5Mac • Wed, 22 Apr 2026

Mosyle identifies two new macOS threats invisible to antivirus engines

After exclusively sharing details with 9to5Mac last September on ModStealer , a cross-platform infostealer invisible to every major antivirus engine at the time, Mosyle , a leader in Apple device management and security, is back with two more macOS threats that are flying completely under the radar. In new details again shared with 9to5Mac , the Mosyle Security Research Team says it has identified two previously undetected samples: Phoenix Worm, a cross-platform stager, and ShadeStager, a modular macOS implant built for credential theft. The two aren’t directly connected in how they work, but together show just how sophisticated Mac malware is getting. more…

What happened?

After exclusively sharing details with 9to5Mac last September on ModStealer , a cross-platform infostealer invisible to every major antivirus engine at the time, Mosyle , a leader in Apple device management and security, is back with two more macOS threats that are flying completely under the radar. In new details again shared with 9to5Mac , the Mosyle Security Research Team says it has identified two previously undetected samples: Phoenix Worm, a cross-platform stager, and ShadeStager, a modular macOS implant built for credential theft. The two aren’t directly connected in how they work, but together show just how sophisticated Mac malware is getting. more…

Story details

After exclusively sharing details with 9to5Mac last September on ModStealer , a cross-platform infostealer invisible to every major antivirus engine at the time, Mosyle , a leader in Apple device management and security, is back with two more macOS threats that are flying completely under the radar.

In new details again shared with 9to5Mac , the Mosyle Security Research Team says it has identified two previously undetected samples: Phoenix Worm, a cross-platform stager, and ShadeStager, a modular macOS implant built for credential theft.

The two aren’t directly connected in how they work, but together show just how sophisticated Mac malware is getting.

Why it matters

This page keeps Apple rumors separate from official updates, so readers can follow early reports without confusing them with confirmed announcements.

Original source

https://9to5mac.com/2026/04/22/mosyle-identifies-two-new-macos-threats-invisible-to-antivirus-engines/