Microsoft Warns Python Infostealers Target macOS via Fake Ads and Installers

Microsoft warns of rapidly expanding infostealer campaigns that now target macOS as well as Windows by leveraging Python-based cross-platform stealers and platform abuse via malvertising (e.g., ClickFix/Google Ads) to deliver fake installers and DMGs. Multiple stealer families (AMOS, MacSync, DigitStealer, PXA Stealer, Eternidade) are observed using fileless techniques, native utilities, AppleScript, and messaging apps/Telegram for C2, enabling theft of credentials, cookies, iCloud Keychain, developer secrets, and financial data; organizations are advised to educate users and monitor suspicious Terminal activity and network egress.