Microsoft Warns Python Infostealers Target macOS via Fake Ads and Installers

Published:

4 februari 2026 om 07:42:00

Alert date:

4 februari 2026 om 09:00:42

Source:

thehackernews.com

Operating Systems, Ransomware & Malware, Data Breach & Exfiltration, Email & Messaging

Microsoft's Defender Security Research Team has identified a rapidly expanding threat where information-stealing attacks are moving beyond Windows to target Apple macOS environments. The attacks leverage cross-platform languages like Python and abuse trusted platforms for large-scale distribution. The campaigns employ social engineering techniques including ClickFix methods to compromise macOS systems. This represents a significant shift in the threat landscape as cybercriminals expand their targeting beyond traditional Windows environments to include Apple's operating system.

Technical details

Python-based infostealers are targeting macOS using social engineering techniques like ClickFix to distribute disk image (DMG) installers. The attacks use fileless execution, native macOS utilities, and AppleScript automation to steal web browser credentials, session data, iCloud Keychain, and developer secrets. Distribution occurs through malicious Google Ads redirecting to fake sites, phishing emails, and weaponized messaging apps like WhatsApp. Attack chains use registry Run keys or scheduled tasks for persistence and Telegram for command-and-control communications and data exfiltration.

Mitigation steps:

Educate users on social engineering attacks like malvertising redirect chains, fake installers, and ClickFix-style copy-paste prompts
Monitor for suspicious Terminal activity and access to the iCloud Keychain
Inspect network egress for POST requests to newly registered or suspicious domains

Affected products:

macOS
DynamicLake
Mozilla Firefox
Chrome browsers
iCloud Keychain
WhatsApp
Crystal PDF
Google Ads

Related CVE's:

Related threat actors:

Vietnamese-speaking threat actors

IOC's:

Atomic macOS Stealer (AMOS), MacSync, DigitStealer, PXA Stealer, Eternidade Stealer, Crystal PDF fake editor, DMG installer files, ClickFix lures, POST requests to newly registered or suspicious domains, Suspicious Terminal activity, Telegram C&C communications

This article was created with the assistance of AI technology by Perceptive.