Infostealer Campaigns Expand to macOS as Attackers Abuse Python and Trusted Platforms

Infostealer activity that historically targeted Windows is increasingly targeting macOS through both native macOS families (e.g., DigitStealer, MacSync, AMOS) and cross-platform Python stealers. Attackers use malvertising, spoofed download pages, fake apps, and social engineering (including copy-paste Terminal commands) to deploy payloads that leverage built-in utilities and scripting to harvest browser passwords, macOS Keychain data, crypto wallets, and cloud/source-code credentials, then exfiltrate data to attacker-controlled infrastructure — posing elevated risk to consumers and organizations, including potential downstream supply-chain compromise.