Bitdefender 2026 macOS Report: Attacks by Bad Actors Shift to the Browser

Bitdefender has released its macOS Threat Landscape Report 2026 and the report shows that bad actors are increasingly attacking Mac users via the browser. Malicious ads, fake warnings and deceptive downloads are among the methods hackers are using for their nefarious schemes.

The report examines detections from August 2025 through July 2026. Its central finding: attackers are attempting to persuade users to take the final step themselves, with the browser being a favorite avenue to reach them.

Key Takeaways

Bitdefender reports the following:

• Malicious ads, fake warnings and deceptive downloads make the browser a key route to Mac users
• Trojans account for 45.2% of detections, followed by adware at 34.4% and potentially unwanted applications at 20.4%
• Adware shows the biggest increase from our previous report, rising 11.8 percentage points
• Potentially unwanted applications (PUAs) account for roughly one in five detections in that three-category breakdown and can put users’ privacy and security at risk
• ClickFix scams tell users to run malicious commands themselves, often under the guise of a verification step or technical fix

Trojans Still Popular, But Adware is Increasing in Popularity

While Trojans remain the most popular methods among bad guys, adware is increasing quickly in popularity, with its share rising 11.8 percentage points, up from 22.6% to 34.4%.

“Adware” includes:

• Fake security alerts
• Malicious downloads
• Phishing pages

Popunder and Cryxos adware together account for 72.5% of the detections shown.

Potentially Unwanted Apps Approach Continues to be Popular

Potentially unwanted applications (PUAs) account for 20.4% of detections. PUAs pose as harmless installers, cleaners, optimizers or browser add-ons. While they are not always outright malicious, PUAs can change browser settings, display irritating ads, collect data or even install additional software. Once installed, these unwanted apps can slow your Mac, weaken your privacy protections, and expose it to additional threats.

ClickFix Uses Social Engineering

The report also list ClickFix as a continuing threat. The usual approach for ClickFix techniques is to convince users to copy and paste malicious commands into Terminal under the guise of troubleshooting or routine system maintenance. Running such commands can download and execute malware with the user’s own permissions, allowing even fully updated Macs to be exposed.

Infostealers Are Still a Concern

While Inforstealers make up only a small share of Mac detections, they are still dangerous, as they can steal browser passwords and session cookies, cryptocurrency wallet data, keychain contents, and other sensitive files and information.

Stealer-class detections rose from under 1% of monthly Mac reports in mid-2025 to roughly 1.5% by mid-2026.

How to Download the Full Report

The full Bitdefender macOS Threat Landscape Report 2026 can be downloaded from Bitdefender.