Executive Summary
In early 2026, the threat actor 0xFFF (rebranding as alh1mik) launched notnullOSX, a sophisticated macOS infostealer. This malware specifically targets cryptocurrency users with holdings exceeding $10,000, utilizing a highly manual vetting process via an affiliate panel before deploying custom lures. The campaign has been observed in Vietnam, Taiwan, and Spain, using legitimate-looking software such as 'WallSpace' and fake Google Docs errors to trick victims into executing malicious commands.
Technically, notnullOSX is a modular Go-written binary that leverages 'ClickFix' social engineering to persuade users into granting Full Disk Access (FDA), thereby bypassing macOS's Transparency, Consent, and Control (TCC) framework. Once established, it maintains a persistent WebSocket connection via Firebase Realtime Database, allowing it to function as a Remote Access Trojan (RAT) capable of downloading and executing additional modules to steal browser data, iMessage history, Apple Notes, and DevOps credentials.