Bitdefender 2026 macOS Threat Report: attackers are persuading users to let them in

Bitdefender has released its macOS Threat Landscape Report 2026, which finds that malicious ads, fake warnings and deceptive downloads play a growing role in how threats reach Mac users.

A Mac doesn’t have to be compromised through a software flaw for an attack to succeed. A convincing browser page can lead someone to install an unwanted app, hand over credentials or paste a malicious command into Terminal.

The report examines detections from August 2025 through July 2026. Its central finding: attackers often try to persuade users to take the final step themselves, with the browser providing a route to reach them.

Key takeaways

• Malicious ads, fake warnings and deceptive downloads make the browser a key route to Mac users
• Trojans account for 45.2% of detections, followed by adware at 34.4% and potentially unwanted applications at 20.4%
• Adware shows the biggest increase from our previous report, rising 11.8 percentage points
• Potentially unwanted applications (PUAs) account for roughly one in five detections in that three-category breakdown and can put users’ privacy and security at risk
• ClickFix scams tell users to run malicious commands themselves, often under the guise of a verification step or technical fix

Trojans still lead, but Adware is gaining ground

Trojans remain the largest of the three categories (once web and document detections are excluded). But adware shows the biggest change from our previous report: its share rises 11.8 percentage points, from 22.6% to 34.4%.

The name “adware” may sound like a mere annoyance. In practice, an unwanted window or redirect may lead to something more serious:

• A fake security alert
• A malicious download
• A phishing page

Within the report’s Top 10 adware ranking, Popunder and Cryxos together account for 72.5% of the detections shown. Cryxos uses malicious JavaScript to display fake infection warnings and tech support messages that may persuade users to call a scammer or install unwanted software.

Potentially unwanted apps also rely on persuasion

Potentially unwanted applications (PUAs) account for 20.4% of detections in that three-category breakdown. They often appear as useful installers, cleaners, optimizers or browser add-ons. They are not always outright malicious, but can change browser settings, display intrusive ads, collect data or install additional software.

An ad, a software bundle or a convincing download prompt can lead someone to install a program they did not set out to get. Like the fake warnings in adware campaigns, these offers rely on users taking the next step. Once installed, unwanted apps can weaken privacy, slow a Mac or expose it to additional threats.

ClickFix turns the user into the installer

The report also examines ClickFix, a form of social engineering that tells users to run a malicious command themselves.

The setup may look like a CAPTCHA, a browser repair notice or a message claiming that a feature will not work until the user fixes a problem. The page then instructs them to copy and paste a command into Terminal. Running it can download and execute malware with the user’s own permissions.

That’s why even a fully updated Mac can be exposed. The attacker’s aim is to make a harmful instruction look like an ordinary step in a task. The report shows how these scams work and how users can interrupt them.

Infostealers remain a concern

Information stealers account for a relatively small share of Mac detections, but their purpose makes them consequential. Depending on the malware, they may seek browser passwords and session cookies, cryptocurrency wallet data, Keychain contents or other sensitive files.

Stealer-class detections rose from under 1% of monthly Mac reports in mid-2025 to roughly 1.5% by mid-2026. These are detections, not a count of successful data thefts.

Download the full report

Mac security extends beyond keeping the operating system patched.

The report explores how attackers increasingly try to persuade Mac users to take the final step themselves:

• clicking through a malicious ad
• installing a potentially unwanted app
• or pasting a command into Terminal

Download the full Bitdefender macOS Threat Landscape Report 2026 to see how these threats reach you and what you can do to stop them.