Microsoft has warned that information-stealing attacks are rapidly expanding beyond Windows to target Apple macOS environments using cross-platform languages such as Python.
The software giant’s Defender Security Research Team has observed macOS-targeted infostealer campaigns using social engineering techniques like ClickFix since late 2025 to distribute disk image (DMG) installers that deploy stealer malware families like Atomic macOS Stealer (AMOS), MacSync, and DigitStealer.
The campaigns have been using techniques like fileless execution, native macOS utilities, and AppleScript automation to facilitate data theft, including web browser credentials and session data, iCloud Keychain, and developer secrets.
The basis for these attacks is usually a malicious ad, most often delivered via Google Ads, that tricks users searching for tools such as DynamicLake and artificial intelligence (AI) tools into visiting fake websites that use ClickFix lures, fooling users into infecting their own systems with malware.
“Python-based stealers are being leveraged by attackers to rapidly adapt, reuse code, and target heterogeneous environments with minimal overhead,” Microsoft said. “They are typically distributed via phishing emails.”
The company added: “Three major Mac-focused stealer campaigns include DigitStealer (distributed through fake DynamicLake software), MacSync (delivered via copy-paste Terminal commands), and Atomic Stealer (using fake AI tool installers).”
The company said all three harvest the same types of data, browser credentials, saved passwords, cryptocurrency wallet information, and developer secrets. From there, everything is sent to attacker servers before deleting traces of the infection.
Another, PXA Stealer, has been linked to Vietnamese-speaking threat actors and can harvest login credentials, financial information, and browser data. Microsoft said it identified two PXA Stealer campaigns that used phishing emails for initial access.
Also, threat actors have been observed weaponizing popular messaging apps like WhatsApp to distribute malware like Eternidade Stealer to get their hands on access to financial and cryptocurrency accounts.
Pre-empting Attackers
Trey Ford, Chief Strategy and Trust Officer at Bugcrowd, said this attack highlights the need to maintain a continuous offensive view of our technology estate, in an effort to identify and address exposed vulnerabilities before adverse events.
“Threat actors are moving faster than many defenders, increasingly leveraging AI-powered offensive capabilities to gain a foothold to meet their objectives. The classical “annual penetration test” is far from effective today, it is time that we (defenders, service providers, and the regulatory and audit groups) refactor the objectives of offensive testing from a first-principles perspective. The goal should be to pre-empt attackers in identifying and addressing exposures, preventing adverse outcomes.”
Leveraging Cross-Platform Languages
Robert Coles, Senior Cybersecurity Engineer at Black Duck, said infostealers are evolving as one of the most effective initial access tools used by today’s threat actors. “Once considered a Windows only issue, the threat is now operating across Windows and macOS, leveraging cross-platform languages such as Python. This is not your typical attack, using a software vulnerability. Instead, the user is persuaded into running a trusted system utility to “fix” something or run a trojanized installer that appears to be a legitimate application.”
Malvertising, phishing, and fake software updates are typically used to deliver the infostealer, Coles added. “Once a user is convinced to run the compromised application, it will harvest browser credentials and cookies, session tokens to bypass multi-factor authentication (MFA), financial and crypto data, and even gather cloud, developer, and API credentials.”
He said using stolen credentials can lead to account takeovers across Software as a Service (SaaS) and cloud platforms. Follow-on attacks could also happen, such as ransomware and business email compromise (BEC).
Defending against these attacks takes both the human and technology, Coles explained. “For the human, user awareness training that will provide focus on fake installers, updates, and command execution. Technology driving defense should include behavior-based endpoint protection, blocking untrusted software, least-privilege, and monitoring outbound traffic. It is now more important than ever to consistently apply this to both Windows and macOS.”
Targeting Overconfident Environments
Shane Barney, Chief Information Security Officer at Keeper Security, commented. “Infostealer campaigns like this work because they target the point where most environments are still overconfident: what happens after access is granted. These attackers are not trying to defeat macOS security controls. They are deliberately avoiding that path by convincing users to install software or run commands that appear legitimate. Once that step occurs, the operating system largely fades into the background.”
By relying on native tools, scripting languages like Python and trusted distribution channels, attackers blend into normal activity and minimize detection, Barney said. “The real objective is to quietly collect credentials, session tokens and developer secrets that can be reused later. In many environments, those stolen credentials are not even tied to a human login. They include service tokens, API keys and automation credentials that operate continuously and often without the same visibility or controls.”
He said this is why these campaigns scale so effectively. “A valid session token or developer credential works just as well on macOS as it does on Windows, and it bypasses many of the controls security teams still rely on to identify intrusions.”
The defensive takeaway is uncomfortable but necessary, Barney concluded. “Security teams can no longer assume that stopping infection is enough. Modern environments have shown that credential exposure is inevitable at some point. The priority must be limiting what those credentials can do once compromised.”
Information Security Buzz News Editor
Kirsten Doyle has been in the technology journalism and editing space for nearly 24 years, during which time she has developed a great love for all aspects of technology, as well as words themselves. Her experience spans B2B tech, with a lot of focus on cybersecurity, cloud, enterprise, digital transformation, and data centre. Her specialties are in news, thought leadership, features, white papers, and PR writing, and she is an experienced editor for both print and online publications.
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.