delta-canvas.com: a Mac malware download site and what to do if you opened its files

What delta-canvas.com is, and what we know about it

delta-canvas.com is not a program on your Mac. It is a web address that the abuse.ch project URLhaus lists as a place where Mac malware was served. We found no public write-up of this one site, so this page rests on what the URLhaus rows show, what the domain registration shows, one plain request from our server, and what security vendors have published about the kind of Mac malware that is spread this way.

1. 1

   What URLhaus lists

   Five file addresses on delta-canvas.com, all in a folder called zxc and all added on 23 September 2026 at 07:22 UTC by one reporter. Three are zip archives: app.zip, apptwo.zip and appex.zip. Two have no file ending, mdw and kito, and carry the tag macho. Every row also carries the tag macOS. The threat type on every row is malware_download. When we read the rows, app.zip was marked online and the other four offline.

2. 2

   What the tags mean

   macOS says the files are meant for a Mac. zip says the file is an archive that you open by double clicking. macho says the file is a Mach-O program, the native executable format of macOS and iOS. None of the rows carries a malware family name, so we cannot tell you whether this is a password stealer, a loader, a backdoor or something else.

3. 3

   What we could not confirm

   We did not download any of the five files and we did not see the page that leads people to them. So we do not know what lure the site uses, what is inside the zip files, what mdw and kito do, or whether a ClickFix style command is involved. Anything said below about malware families is background from vendors, not a finding about these files.

4. 4

   What this means for you

   If you only saw the name in a log, a link or a warning, you are not infected by that alone. The risk is for people who downloaded a file from the site and opened it, ran a program from it, or pasted a command it showed them into Terminal on a Mac.

Kind of threat

A malware download site for macOS: five reported file addresses, family not named

Files reported

app.zip, apptwo.zip, appex.zip (zip archives), mdw and kito (Mach-O programs), all under /zxc/

Domain registered

22 September 2026 at 13:58 UTC, registrar Eranet International Limited, status client transfer prohibited (RDAP, read 17 October 2026)

URLhaus entries

5 file addresses, all added 23 September 2026 at 07:22 UTC; 1 online (app.zip) and 4 offline when we read them

Hosted behind

Cloudflare: our request was answered by a Cloudflare server, so the real server is not visible to us

Platform

macOS, by the tags. Whether Windows, iPhone or Android are hit is not stated by any source we read

What we checked on 17 October 2026, and what we could not

Our check was one plain request from our server: no browser, no clicks, no scrolling. The site answered with a Cloudflare 520 error. That tells you nothing good about the site, and it clears nothing.

What happened to delta-canvas.com, from registration to our check

The history is short because the domain is under a month old at the first report. The dates come from RDAP, from the URLhaus rows and from our own request.

1. 22 September 2026

   The domain is registered

   RDAP shows delta-canvas.com registered on 22 September 2026 at 13:58 UTC through the registrar Eranet International Limited. The only status is client transfer prohibited, which is a lock against moving the domain to another registrar and says nothing about its use.

2. 23 September 2026

   Five malware URLs are reported

   At 07:22 UTC a reporter using the handle c4ffeine adds app.zip, apptwo.zip, appex.zip, mdw and kito, all under /zxc/, with the tags macOS, zip or macho. That is about 17 hours after the domain was registered, which suggests it was set up for this purpose, though no source states the intent.

3. 17 October 2026

   Our request gets a 520

   Our server asks for the site and receives a Cloudflare 520 error. At the time of our reading, the URLhaus data we hold still lists app.zip as online. We hold no record of any later report for the domain.

The same folder and file names appear on another domain

The folder zxc and the file names app.zip, apptwo.zip and appex.zip are not unique to this site. The same set of names appears in URLhaus reports for loop-lumen.com, another domain we have a guide for, where the reporter's tags named the Atomic macOS Stealer (AMOS) and ClickFix.

That is a reason to read the AMOS background below, and it is not proof. The delta-canvas.com rows carry no family tag, the two sites have different registrars and registration dates, and we do not know whether the same people run both.

Our reading is that the pattern looks like a reused kit, and we label it as our reading, not as a finding. Do not assume that the files on delta-canvas.com are AMOS.

How a paste-a-command trick works on a Mac

We did not see delta-canvas.com's page, so we do not know if it uses this trick. Kaspersky and Unit 42 describe it as a common way Mac stealers reach people, which is why it is explained here.

1. 1

   You land on a page with a check or a guide

   Kaspersky describes a fake CAPTCHA or verification step on a hacked or fake website. Unit 42 describes a page advertising a macOS toolkit with quick setup instructions. Both end with a command to copy.

2. 2

   You are told to open Terminal and paste

   Because you run the command yourself, Kaspersky notes that macOS security warnings are often dismissed as part of the instructions. Its test command raised no warning at all on macOS Tahoe 26.5.2.

3. 3

   The command fetches the real malware

   In Kaspersky's example the command downloads a disk image into the /tmp folder under a random name, mounts it without showing it in Finder or on the desktop, finds the app inside and launches it. In Unit 42's example the command fetched a Zsh script, which unpacked a second script, which downloaded a Mach-O installer saved as /tmp/helper.

4. 4

   A password box appears

   Kaspersky and Sophos both describe a fake macOS system window asking for your password. Sophos says the malware keeps asking until a correct password is entered, then uses it for actions that need administrator rights.

5. 5

   Nothing seems to happen

   That is the aim. Unit 42 saw Terminal ask for access to Finder, the Desktop, Documents and Notes during its test infection, and then the data left the Mac in the background.

Unit 42 says its toolkit example is not technically ClickFix, because it does not pose as a check, though the copy and paste step is the same. For the reader the rule is the same too: no website needs you to paste anything into Terminal.

Background: what a Mac stealer such as AMOS is

The table is background on the best documented Mac stealer that is spread by zip files and pasted commands. It describes AMOS, the Atomic macOS Stealer, in general. It is not a statement about the delta-canvas.com files.

What a Mac stealer of this kind takes

If the files turn out to be a stealer, this is the range of what such malware collects in one sweep. Each item is named by at least one source about AMOS; no single source lists all of them, and nothing here is confirmed for the delta-canvas.com files.

What this can cost you

Reading the site or seeing its name costs nothing. The risks below apply to a Mac where a file from the site was opened or a command from it was pasted, and they are the risks of the malware type described above, not proven for these files.

• High

  Account takeover

  Cookies and session tokens let someone use your logged in email, social and work accounts without your password, so a stolen session can outlive a password change until you sign out everywhere.

• High

  Crypto theft

  Wallet files and recovery phrases are a main prize of Mac stealers. A blockchain transfer cannot be reversed, so speed and order matter more here than anywhere else.

• High

  Your Mac password in the attackers' hands

  Both Kaspersky and Sophos describe a fake password prompt. With your password an attacker can read the Keychain and approve actions on that Mac, so changing it matters as much as changing the web passwords.

• Medium

  Keys and tokens from your work

  Unit 42 saw cloud, container and file transfer config folders taken. If you are a developer, keys and API tokens on the Mac are exposed.

• Medium

  A hidden program that starts again

  Sophos describes a LaunchDaemon and a hidden helper in the user folder. Until such leftovers are gone, the Mac can keep talking to the attackers.

• Low

  Nothing, if you only saw the name

  A name in a warning, a firewall log or a blocked link is not an infection.

What you may notice, and what you may not

Most victims of Mac stealers notice nothing. The signs below come from the vendor reports on AMOS, and the first three happen during the infection, not after it.

How people end up on a page like this

We do not know how visitors reach delta-canvas.com, and no source says. The routes below are the ones the sources name for Mac stealers in general.

1. 1

   A fake human check on a site you wanted

   A hacked or fake page shows a CAPTCHA style check and sends you on. Kaspersky describes this form.

2. 2

   A malicious ad or a poisoned search result

   Unit 42 says AMOS has been spread through malicious ads, and Sophos names poisoned search results, including ones tied to AI chat answers, and AI themed lures.

3. 3

   A cracked or free copy of Mac software

   Sophos and Unit 42 both name cracked app and fake installer lures. A site that offers a paid Mac app for free is a typical place for a zip like app.zip.

4. 4

   A download you started

   Three of the five reported files are zip archives. Opening a downloaded zip that claims to be an app, or running a bare program such as mdw or kito, is another way in.

Check your Mac before you delete anything

Start with the question that matters: did you open a file from delta-canvas.com, or paste a command from a page on it? If yes, stop here and follow the numbered plan on this page, because a clean looking check does not clear a Mac. If you are not sure, do the checks below first. None of them deletes anything.

While you check, stop using the Mac for banking, email, work or crypto, and take it off the network if you can, so that anything running cannot send more data out.

1. 1

   Think back to what you opened

   Look in your Downloads folder in Finder for app.zip, apptwo.zip, appex.zip, mdw or kito, or for an app that appeared after a visit to a page you do not trust. Do not open or run them again. Note the date you downloaded them.

2. 2

   Look at Login Items and background items

   Open Apple menu > System Settings > General > Login Items & Extensions. Apple says this list holds items that open at login and apps allowed to run in the background. Look for names you did not install, including names that copy Apple's, such as accountsd, mdworker or softwareupdate. To remove an entry, select it and click the Remove button below the list.

3. 3

   Look for the hidden folders other reports found

   In Finder choose Go > Go to Folder and type /Library/Application Support/. Unit 42 found hidden folders named .com.apple.accountsd and .com.apple.metadata.mds there, which copy Apple's names. Sophos lists a plist named com.finder.helper.plist in /Library/LaunchDaemons/. These names come from other samples, so a match is a strong sign and no match clears nothing.

4. 4

   Look in the home folder and in /tmp

   In Terminal, ls -la ~ lists hidden files in your home folder and only lists them. Sophos describes a hidden helper binary there. Unit 42 saw installers and staging files in /tmp, such as helper, starter and out.zip, but /tmp is cleared by macOS, so an empty folder proves nothing.

5. 5

   Check your accounts

   Look at the sign-in activity of your email, your Apple Account, banks and exchanges for places and devices you do not know. Look at your crypto balances. This is quicker than any file check, and it is done from another device.

6. 6

   A scan helps, but it does not clear the Mac

   A scan with a Mac security product can find known files. Treat a clean result as one data point, the way you treat a clean site test. We found no vendor removal procedure for these five files and we infected no Mac, so the order of the plan is our judgement from the vendor reports and Apple's pages, not a tested result.

If you use Windows, an iPhone or an Android phone

The tags say macOS and every vendor source we read describes a Mac threat. We found nothing that says the five delta-canvas.com files run on anything else.