Sophisticated macOS Infostealers Get Past Apple's Built-In Detection

Researchers report that multiple macOS infostealers — KeySteal, Atomic Stealer, and CherryPie — are actively evolving to bypass Apple’s XProtect and other detection systems by using multi-architecture binaries, language rewrites, anti-analysis/VM checks, and clear hardcoded C2s; distribution appears to leverage dmg/pkg installers, torrents, and gaming-focused channels, and the activity underscores a rising trend of macOS-focused credential and wallet theft that requires updated detection and monitoring.