Loading story…
Threat actors are increasingly abusing trusted platforms and familiar workflows to steal credentials and session data, with infostealer operations expanding beyond Windows into macOS. Reported campaigns use malvertising, search-engine poisoning, fake apps, and DMG-packaged installers to deliver cross-platform Python-based stealers and macOS-focused families (including AMOS, DigitStealer, and MacSync) that target browser passwords, Keychain data, crypto wallets, and developer/cloud secrets; this credential theft can enable follow-on compromise such as source-code access abuse, supply-chain intrusion, and ransomware.
Separately reported phishing activity shows similar “trust abuse” patterns: a fake Dropbox credential-harvesting chain uses benign-looking PDFs and legitimate cloud hosting (e.g., Vercel Blob storage) to evade scanners and email controls, then exfiltrates captured credentials via Telegram. Another technique, ConsentFix/AuthCodeFix, abuses the OAuth 2.0 authorization-code flow by coercing victims into copying a localhost redirect URL containing an authorization code (often for implicitly trusted first-party apps like Azure CLI), allowing attackers to exchange it for tokens and effectively bypass MFA and Conditional Access protections.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft researchers observed infostealer operations increasingly targeting macOS with cross-platform Python tooling and macOS-native techniques delivered through malvertising, fake apps, phishing, and abuse of trusted platforms. The malware uses built-in macOS automation and utilities to steal credentials, cookies, keychain data, and crypto-related information for exfiltration to attacker-controlled infrastructure.
A phishing campaign impersonating Dropbox was reported using procurement-themed emails with a PDF attachment that links to a second PDF hosted on Vercel Blob storage, which then redirects victims to a fake Dropbox login page. The page captures credentials, collects victim IP and geolocation data, and exfiltrates the stolen information through a Telegram bot.
Researchers described ConsentFix, also called AuthCodeFix, a phishing method that tricks victims into pasting a localhost redirect URL containing a Microsoft OAuth authorization code for a trusted first-party app such as Azure CLI. Attackers can exchange the stolen code for tokens without triggering a new Conditional Access evaluation, enabling MFA and policy bypass.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft reported that infostealer operators have broadened beyond traditional Windows-focused activity to target **macOS** and mixed-platform environments through social engineering, malicious installers, and abuse of trusted services. Since late 2025, researchers observed campaigns delivering **DigitStealer**, **MacSync**, and **Atomic macOS Stealer (AMOS)** via fake software downloads, malicious `.dmg` files, and **ClickFix**-style prompts that trick users into running Terminal commands, leading to theft of browser credentials, cryptocurrency wallet data, Keychain contents, and developer secrets. The company also linked multiple cross-platform and Python-based operations to the trend, including **PXA Stealer**, attributed to Vietnamese-speaking threat actors targeting government and education organizations through phishing, persistence mechanisms, and Telegram-based exfiltration. Separate campaigns used **WhatsApp** to spread **Eternidade Stealer** with worm-like propagation and pushed a fake **Crystal PDF** installer through malvertising and SEO poisoning to capture browser sessions and credentials. Microsoft said the activity increasingly relies on fileless execution, native utilities, obfuscation, **LOLBINs**, and trusted platforms to evade detection, and published Defender XDR detections, hunting queries, indicators of compromise, and mitigation guidance.
Jun 30, 2026
Threat actors are escalating **macOS infostealer** activity through multiple distribution and evasion techniques aimed at harvesting sensitive user data. One campaign abuses trust in legitimate AI platforms by promoting shareable *ChatGPT* and *Grok* conversation links via **Google Ads**, luring users searching for common macOS troubleshooting help into running malicious Terminal commands using the **“ClickFix”** social-engineering pattern. Executing the provided shell commands results in installation of **Atomic macOS Stealer (AMOS)**, which steals browser credentials, crypto wallet seed phrases, **Keychain** data, and personal files before exfiltrating them to attacker-controlled infrastructure. Separately, **Odyssey Stealer** intrusions against macOS have surged globally, with notable targeting reported in the U.S., France, and Spain and additional impact across Europe, the Americas, and parts of Asia and Africa. Moonlock Lab reporting indicates Odyssey is delivered through **fake software updates, cracked tools, and fraudulent apps**, and is designed to evade detection by generating a **unique fingerprint per infection**, frequently changing code structure, and using many distinct **SHA-256** variants—suggesting automated builders are being used to produce large numbers of hard-to-block samples. Collectively, the reporting highlights sustained pressure on macOS users from credential-stealing malware that blends high-trust lures with rapid variant generation to hinder traditional defenses.
Jun 29, 2026
Threat actors are increasingly targeting macOS users with **infostealers** and distribution-as-a-service models, reflecting a broader “gold rush” in Apple-focused malware development. Reporting highlights macOS stealers targeting browser credentials and cryptocurrency assets (including seed phrases) and notes tactics to evade Apple controls such as obtaining valid Apple developer signatures to bypass *Gatekeeper*; one cited example is *MacSync* being notarized and signed under Team ID `GNJLS3UYZ4`. The same reporting describes ecosystem-scale enablement, including large-scale compromise of WordPress sites for distribution and novel command-and-control approaches such as using blockchain smart contracts (e.g., on **BNB Smart Chain**), alongside paid-traffic abuse (e.g., promoting malicious AI chat content via ads) to push stealer payloads. Separately, a Darktrace-described investigation details a **multi-stage macOS malware** campaign that prioritizes *social engineering* over exploitation to defeat Apple’s **Transparency, Consent, and Control (TCC)** privacy framework. Victims are lured via phishing to open an AppleScript masquerading as a document (`Confirmation_Token_Vesting.docx.scpt`), which displays a fake “Compatibility” error and instructs the user to launch a “Compatibility Wizard” (e.g., using a keyboard shortcut) that effectively tricks them into authorizing execution and granting access. Together, the reporting indicates macOS threats are increasingly succeeding by combining credential/crypto theft objectives with user-prompt manipulation and trust-abuse techniques rather than relying on kernel or sandbox escapes.
Jun 29, 2026