Loading malware…
FrigidStealer is a macOS information-stealing malware family associated with web-inject and fake browser update campaigns linked to the financially motivated threat clusters TA2726 and TA2727. It is delivered to Mac users through compromised websites and browser-themed fake update lures, including ClickFix-style social engineering and disk image installers that instruct victims to bypass Gatekeeper protections and, in some cases, provide their password through AppleScript-driven prompts. The malware has been described as a Go-based Mach-O binary built with the Wails framework and has also been reported as part of the broader Ferret malware family.
Once executed, FrigidStealer targets high-value user data on macOS systems, including browser credentials, stored passwords, cookies and session material, Apple Notes content, and cryptocurrency-related files. Reporting also indicates collection of browser data from Safari and Chromium-based browsers, along with theft of wallet-related and other sensitive files from common user directories. Some reporting describes DNS-based exfiltration behavior via native macOS networking components, as well as post-execution self-termination and cleanup intended to reduce forensic visibility.
FrigidStealer is part of a broader criminal ecosystem using compromised legitimate websites, traffic distribution services, and fake software update themes to selectively deliver different payloads by geography and platform. In observed campaigns, TA2726 functioned as a traffic broker while TA2727 delivered FrigidStealer to macOS users and other malware families to Windows and Android victims. The malware poses risk to both consumer and enterprise environments because theft of credentials and session artifacts can enable follow-on account compromise, cloud access abuse, and financial theft.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Its traffic currently also serves TA2727, which delivers different payloads to MacOS users, including FrigidStealer.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
TA569 can be considered the “grandfather” of a threat type that compromises websites and uses traffic direction systems (TDS) to redirect visitors to malware.
Upon execution, FrigidStealer uses Apple script files and osascript to prompt the user to enter their password, and then to gather data including browser cookies, files with extensions relevant to password material or cryptocurrency from the victim’s Desktop and Documents folders, and any Apple Notes the user has created.
SocGholish web injects impersonate browser security updates to trick users into downloading malware... Clicking it sends a ”postMessage” to a separate hidden iframe... and triggers the download.
If a Mac user outside of North America visited the compromised website from a web browser, they were redirected to a fake update page that, if the Update button was clicked, downloaded and installed an information stealer.
Typically, a TA569 attack chain consists of three parts: the malicious SocGholish injects served to website visitors; a traffic distribution service (TDS) responsible for determining which user receives which payload based on a variety of filtering options...
The MSI installed and executed the legitimate and signed application “Rene.E Facebook Widget”. However, one of the bundled DLLs was trojanized with DOILoader, which was side loaded upon execution.
Typically, a TA569 attack chain consists of three parts: the malicious SocGholish injects served to website visitors; a traffic distribution service (TDS) responsible for determining which user receives which payload based on a variety of filtering options...
Upon execution, FrigidStealer uses Apple script files and osascript to prompt the user to enter their password, and then to gather data including browser cookies...
“Once installed, the malware extracts browser cookies, stored passwords…”
The actor used filtering to determine what browser the recipient used and downloaded the payload that aligned with their browser.
Upon execution, FrigidStealer uses Apple script files and osascript to prompt the user to enter their password, and then to gather data including browser cookies, files with extensions relevant to password material or cryptocurrency from the victim’s Desktop and Documents folders, and any Apple Notes the user has created.
Typically, a TA569 attack chain consists of three parts: the malicious SocGholish injects served to website visitors; a traffic distribution service (TDS) responsible for determining which user receives which payload based on a variety of filtering options...
That data is added to folders in the user’s home directory and then exfiltrated to C2, askforupdate[.]org.
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.