NotLockBit ransomware targets Apple users with advanced file-locking and data exfiltration


The recent discovery of macOS.NotLockBit suggests a shift in the landscape, as this newly identified malware, named after the notorious LockBit variant, could mark the beginning of more serious ransomware campaigns against Mac users.

Ransomware targeting Mac devices tends to lack the necessary tools to truly lock files or exfiltrate data. The general perception has been that macOS is better protected against these kinds of threats, partially due to Apple’s built-in security features, such as Transparency, Consent, and Control (TCC) protections. However, the emergence of macOS.NotLockBit signals that hackers are actively developing more sophisticated methods for targeting Apple devices.

Read more…
Source: MSN News


Sign up for our Newsletter


Related:

  • Telus probes cybersecurity incident that ‘ShinyHunters’ group claims responsibility for

    March 12, 2026

    Canadian telecommunications and business services firm Telus is investigating a cybersecurity incident involving unauthorized access to some ‌of its systems, a company spokesperson said on Thursday. The ShinyHunters hacking group told Reuters in a message it stole at least 700 terabytes ​of data from Telus. All business ​operations within the company “remain fully operational, and there ...

  • CISA warns max-severity n8n bug is being exploited in the wild

    March 12, 2026

    The US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that hackers are exploiting a max-severity remote code execution (RCE) vulnerability in workflow automation platform n8n. CISA urged all federal civilian executive branch (FCEB) agencies to patch CVE-2025-68613 at once because it carries a near-perfect 9.9 vulnerability score. The bug was first disclosed in December, and ...

  • Iran-linked hackers launch cyberattack against U.S. medtech company Stryker

    March 11, 2026

    U.S. medical technology company Stryker is currently experiencing a massive cyberattack, which has shut down their computer systems and, as a result, even closed the company’s offices. An Iran-linked digital activist collective known as Handala is claiming credit for the cyberattack against Stryker. This would be the first major cyberattack carried out in the wake of the ...

  • Russian hackers target HR departments with vicious new ‘BlackSanta’ malware

    March 11, 2026

    Russian hackers have been targeting Human Resources (HR) departments at various organizations around the world with a never-before seen piece of malware called BlackSanta. The campaign was spotted by cybersecurity researchers Aryaka, who said the attacks have been going on for at least a year, and include a rather sophisticated infection chain. It most likely starts ...

  • BeatBanker: A dual‑mode Android Trojan

    March 10, 2026

    Recently, Kaspersky researchers uncovered BeatBanker, an Android‑based malware campaign targeting Brazil. It spreads primarily through phishing attacks via a website disguised as the Google Play Store. To achieve their goals, the malicious APKs carry multiple components, including a cryptocurrency miner and a banking Trojan capable of completely hijacking the device and spoofing screens, among other ...

  • Ericsson US reveals employee and customer data breach after third-party hack

    March 10, 2026

    The US arm of Ericsson has confirmed suffering a third-party data breach which saw it lose sensitive data on an undisclosed number of its customers. In a data breach notification letter sent out to affected individuals, Ericsson US said it spotted “a suspicious event” and potential unauthorized access to its systems on April 28, 2025. The ...