Infostealer campaigns have expanded beyond Windows to target macOS and cross-platform environments, using social engineering, fileless execution, AppleScript automation, and abuse of trusted platforms to harvest browser credentials, keychain items, developer secrets, and cryptocurrency wallets. Microsoft observed macOS campaigns distributing DigitStealer, MacSync, and AMOS via fake installers and ClickFix prompts, and Python-based campaigns like PXA Stealer and Eternidade Stealer using phishing, WhatsApp automation, and malicious PDF tools to exfiltrate data. #DigitStealer #PXA_Stealer
Keypoints
- Infostealer activity has shifted to include macOS-targeted campaigns (DigitStealer, MacSync, AMOS) that use fake installers, ClickFix copyâpaste prompts, and malicious DMGs to harvest browser credentials, wallets, keychain items, and developer secrets.
- Python-based stealers (notably PXA Stealer) enable rapid, cross-platform reuse and are distributed via phishing, establishing persistence (registry run keys, scheduled tasks) and exfiltrating data via services like Telegram.
- Threat actors are abusing widely trusted platforms and utilities (WhatsApp, PDF tools, AutoIt, LOLBINS) to propagate malware such as Eternidade Stealer and Crystal PDF, enabling worm-like spread and large-scale credential theft.
- Attack techniques include fileless execution pipelines (curl | base64 -d | gunzip), AppleScript/JXA automation, DLL sideloading, process injection/hollowing, and obfuscated Python scripts to evade detections.
- Microsoft Defender XDR provides detections and hunting queries covering suspicious Terminal/osascript activity, renamed/masquerading Python binaries, scheduled tasks/LaunchAgent persistence, compression of staged data, and network egress to C2 endpoints.
- Key mitigations include user education against malvertising and ClickFix lures, blocking unsigned DMGs and suspicious installers, monitoring for ephemeral ZIP creation under /tmp, controlling outbound traffic, enabling cloud-delivered protection and EDR in block mode, and applying attack surface reduction rules.
MITRE Techniques
- [T1059 ] Command and Scripting Interpreter â Used for execution of various commands and scripts via PowerShell, osascript, and sh; quote: âExecution of various commands and scripts via osascript and shâ
- [T1547 ] Boot or Logon Autostart Execution â Persistent mechanisms observed via Registry Run keys and macOS LaunchAgent/LaunchDaemon; quote: âRegistry Run key createdâ / âLaunchAgent or LaunchDaemon for recurring executionâ
- [T1053 ] Scheduled Task/Job â Adversaries create scheduled tasks for recurring execution and persistence; quote: âScheduled task created for recurring executionâ
- [T1574 ] Hijack Execution Flow (DLL sideloading) â Unauthorized code execution facilitated by DLL sideloading to load malicious components; quote: âUnauthorized code execution facilitated by DLL sideloading and process injectionâ
- [T1055 ] Process Injection â Processes were injected with potentially malicious code to evade detection and run stealers; quote: âA process was injected with potentially malicious codeâ
- [T1027 ] Obfuscated Files or Information â Attackers use obfuscated Python scripts and encoded payloads to hide malicious behavior; quote: âobfuscated Python scriptsâ
- [T1218 ] Signed Binary Proxy Execution (LOLBIN abuse) â Use of legitimate, signed binaries and living-off-the-land utilities (e.g., certutil, AutoIt) to decode or execute payloads; quote: âthe use of signed and living off the land binariesâ / âDecode payload with certutilâ
- [T1140 ] Deobfuscate/Decode Files or Information â Tools like certutil are used to decode payloads delivered by attackers; quote: âDecode payload with certutilâ
- [T1560 ] Archive Collected Data â Sensitive browser information and other harvested data compressed into ZIP files for staging and exfiltration; quote: âSensitive browser information compressed into ZIP file for exfiltrationâ
- [T1082 ] System Information Discovery â System and environment information queried using WMI and Python to profile victims; quote: âSystem information queried using WMI and Pythonâ
- [T1555 ] Credentials from Password Stores â Theft of passwords and other sensitive web browser information, keychain, and developer secrets; quote: âPossible theft of passwords and other sensitive web browser informationâ
- [T1071 ] Application Layer Protocol (C2) â Use of web protocols and services (including Telegram and web POST to C2 APIs) for command-and-control and exfiltration; quote: âexfiltrated the data via Telegramâ / âCommunication to command and control serverâ
- [T1036 ] Masquerading â Renamed Python interpreter masquerading as a system process (svchost.exe) to hide malicious execution; quote: âPython interpreter masquerading as a system process (i.e., svchost.exe)â
Indicators of Compromise
- [SHA-256 ] Payload hashes related to macOS and platform-abuse campaigns â 3e20ddb90291ac17cef9913edd5ba91cd95437da86e396757c9d871a82b1282a, da99f7570b37ddb3d4ed650bc33fa9fbfb883753b2c212704c10f2df12c19f63, and 22 other hashes
- [SHA-256 ] Payload hashes related to PXA / WhatsApp / CrystalPDF campaigns â 598da788600747cf3fa1f25cb4fa1e029eca1442316709c137690e645a0872bb, 42d51feea16eac568989ab73906bbfdd41641ee3752596393a875f85ecf06417, and multiple additional hashes
- [Domain ] Deceptive or C2 domains used to deliver installers and host payloads â dynamiclake[.]org (DigitStealer delivery), alli-ai[.]pro (AMOS redirect), and other C2 domains such as booksmagazinetx[.]com
- [URL ] Malicious download and phishing URLs â hxxps://allecos[.]de/DocumentaciĂłn_del_expediente_de_derechos_de_autor_del_socio.zip (PXA initial ZIP), hxxps[:]//empautlipa[.]com/altor/installer[.]msi (WhatsApp/Eternidade initial MSI)
- [IP Address ] Command-and-control and payload servers â 217.119.139[.]117 (AMOS C2), 157[.]66[.]27[.]11 (PureRAT/PXA C2)
- [File Name / Executable ] Malicious or abused filenames observed â CrystalPDF.exe (malicious PDF editor masquerade), Autoit3.exe / AutoIt scripts (AutoIT-based payload execution)
- [File Path / Behavior ] Staging and artifact patterns â transient ZIP creation under /tmp for staged exfiltration and disk image mounting commands like â/Volumes/Install DynamicLakeâ used by DMG-based installers