Hackers Target macOS Users with Malicious Ads Spreading Stealer Malware

Jamf Threat Labs and Moonlock Lab report active malvertising and look-alike websites delivering macOS infostealer malware (Atomic Stealer and a Rust-based Realst-like stealer) through fake DMG installers and sponsored search links; attackers use obfuscated AppleScript/bash payloads and deceptive password prompts to harvest macOS credentials, browser-stored logins, keychain data and cryptocurrency wallet information. The advisory also highlights similar Windows-focused malvertising pushing loaders (FakeBat/EugenLoader) and information stealers like Rhadamanthys, and provides example IOCs (domains such as airci.net and meethub.gg, DMG filenames) and observed TTPs.