Bitdefender has released its macOS Threat Landscape Report 2026 and the report shows that bad actors are increasingly attacking Mac users via the browser. Malicious ads, fake warnings and deceptive downloads are among the methods hackers are using for their nefarious schemes.
The report examines detections from August 2025 through July 2026. Its central finding: attackers are attempting to persuade users to take the final step themselves, with the browser being a favorite avenue to reach them.
Key Takeaways
Bitdefender reports the following:
- Malicious ads, fake warnings and deceptive downloads make the browser a key route to Mac users
- Trojans account for 45.2% of detections, followed by adware at 34.4% and potentially unwanted applications at 20.4%
- Adware shows the biggest increase from our previous report, rising 11.8 percentage points
- Potentially unwanted applications (PUAs) account for roughly one in five detections in that three-category breakdown and can put users’ privacy and security at risk
- ClickFix scams tell users to run malicious commands themselves, often under the guise of a verification step or technical fix
Trojans Still Popular, But Adware is Increasing in Popularity
While Trojans remain the most popular methods among bad guys, adware is increasing quickly in popularity, with its share rising 11.8 percentage points, up from 22.6% to 34.4%.
“Adware” includes:
- Fake security alerts
- Malicious downloads
- Phishing pages
Popunder and Cryxos adware together account for 72.5% of the detections shown.
Potentially Unwanted Apps Approach Continues to be Popular
Potentially unwanted applications (PUAs) account for 20.4% of detections. PUAs pose as harmless installers, cleaners, optimizers or browser add-ons. While they are not always outright malicious, PUAs can change browser settings, display irritating ads, collect data or even install additional software. Once installed, these unwanted apps can slow your Mac, weaken your privacy protections, and expose it to additional threats.
ClickFix Uses Social Engineering
The report also list ClickFix as a continuing threat. The usual approach for ClickFix techniques is to convince users to copy and paste malicious commands into Terminal under the guise of troubleshooting or routine system maintenance. Running such commands can download and execute malware with the user’s own permissions, allowing even fully updated Macs to be exposed.
Infostealers Are Still a Concern
While Inforstealers make up only a small share of Mac detections, they are still dangerous, as they can steal browser passwords and session cookies, cryptocurrency wallet data, keychain contents, and other sensitive files and information.
Stealer-class detections rose from under 1% of monthly Mac reports in mid-2025 to roughly 1.5% by mid-2026.
How to Download the Full Report
The full Bitdefender macOS Threat Landscape Report 2026 can be downloaded from Bitdefender.
