macOS Users Hit by Python Infostealers Posing as AI Installers

Microsoft Defender research identified three major macOS infostealer campaigns—DigitStealer, MacSync, and Atomic Stealer—delivered via fake ads, malicious installers, and social-engineered Terminal commands. These campaigns aim to exfiltrate cryptocurrency wallets, browser-saved passwords, and developer credentials, then remove traces to impede detection; analysts warn the attacks exploit user trust and native macOS tools, posing significant risk to individuals and organizations.