DigitStealer Malware Targets macOS M2+ Devices and Cryptocurrency Wallets

A new macOS infostealer named DigitStealer has been discovered targeting users with Apple M2 or newer devices. The malware is distributed via a fake utility app called DynamicLake, which is hosted on a spoofed website. Victims are tricked into dragging a file into Terminal, initiating a largely fileless infection chain that executes malicious code directly in memory, making detection and remediation difficult. DigitStealer employs advanced anti-analysis techniques, including hardware and locale checks, to evade security tools and avoid infecting virtual machines or systems outside its target region.

The malware demonstrates a high level of sophistication by hijacking legitimate cryptocurrency wallet software such as Ledger Live using JXA (JavaScript for Automation) and communicating with its command-and-control infrastructure via DNS-based channels. Its primary goal is to steal sensitive information, including files, passwords, and browser data, from macOS users. Security researchers warn that DigitStealer's platform-specific targeting and stealthy operation pose significant new challenges for defenders, especially as it remains undetected by many traditional antivirus solutions.