Infostealers without borders: macOS, Python stealers, and platform abuse
Essential information
- Published
- 02/02/2026 22:44
- Modified
- 03/02/2026 10:50
- Tags
- 2026-02-02 atomic macos stealer credential-theft digitstealer eternidade stealer fileless execution infostealer macos macsync platform abuse pxa stealer python social engineering
- Related entities
- 23 observables, 17 techniques (mitre), 5 malware, 19 others
Description
Infostealer threats are expanding beyond Windows, targeting macOS and leveraging cross-platform languages like Python. Recent campaigns use social engineering to deploy macOS-specific infostealers such as DigitStealer, MacSync, and AMOS. These stealers use fileless execution and native macOS utilities to harvest credentials and sensitive data. Python-based stealers are also on the rise, allowing attackers to quickly adapt and target diverse environments. Additionally, threat actors are abusing trusted platforms like WhatsApp and PDF converter tools to distribute malware such as Eternidade Stealer. These evolving threats blend into legitimate ecosystems and evade conventional defenses, posing significant risks to organizations across various operating systems and delivery channels.