Infostealers without borders: macOS, Python stealers, and platform abuse

By: Microsoft Defender Security Research Team

2 February 2026 at 22:04

Infostealer threats are rapidly expanding beyond traditional Windows-focused campaigns, increasingly targeting macOS environments, leveraging cross-platform languages such as Python, and abusing trusted platforms and utilities to silently deliver credential-stealing malware at scale. Since late 2025, Microsoft Defender Experts has observed macOS targeted infostealer campaigns using social engineering techniques—including ClickFix-style prompts and malicious DMG installers—to deploy macOS-specific infostealers such as DigitStealer, MacSync, and Atomic macOS Stealer (AMOS).

These campaigns leverage fileless execution, native macOS utilities, and AppleScript automation to harvest credentials, session data, secrets from browsers, keychains, and developer environments. Simultaneously, Python-based stealers are being leveraged by attackers to rapidly adapt, reuse code, and target heterogeneous environments with minimal overhead. Other threat actors are abusing trusted platforms and utilities—including WhatsApp and PDF converter tools—to distribute malware like Eternidade Stealer and gain access to financial and cryptocurrency accounts.

This blog examines how modern infostealers operate across operating systems and delivery channels by blending into legitimate ecosystems and evading conventional defenses. We provide comprehensive detection coverage through Microsoft Defender XDR and actionable guidance to help organizations detect, mitigate, and respond to these evolving threats.

Activity overview

macOS users are being targeted through fake software and browser tricks

Mac users are encountering deceptive websites—often through Google Ads or malicious advertisements—that either prompt them to download fake applications or instruct them to copy and paste commands into their Terminal. These “ClickFix” style attacks trick users into downloading malware that steals browser passwords, cryptocurrency wallets, cloud credentials, and developer access keys.

Three major Mac-focused stealer campaigns include DigitStealer (distributed through fake DynamicLake software), MacSync (delivered via copy-paste Terminal commands), and Atomic Stealer (using fake AI tool installers). All three harvest the same types of data—browser credentials, saved passwords, cryptocurrency wallet information, and developer secrets—then send everything to attacker servers before deleting traces of the infection.

Stolen credentials enable account takeovers across banking, email, social media, and corporate cloud services. Cryptocurrency wallet theft can result in immediate financial loss. For businesses, compromised developer credentials can provide attackers with access to source code, cloud infrastructure, and customer data.

Phishing campaigns are delivering Python-based stealers to organizations

The proliferation of Python information stealers has become an escalating concern. This gravitation towards Python is driven by ease of use and the availability of tools and frameworks allowing quick development, even for individuals with limited coding knowledge. Due to this, Microsoft Defender Experts observed multiple Python-based infostealer campaigns over the past year. They are typically distributed via phishing emails and collect login credentials, session cookies, authentication tokens, credit card numbers, and crypto wallet data.

PXA Stealer, one of the most notable Python-based infostealers seen in 2025, harvests sensitive data including login credentials, financial information, and browser data. Linked to Vietnamese-speaking threat actors, it targets government and education entities through phishing campaigns. In October 2025 and December 2025, Microsoft Defender Experts investigated two PXA Stealer campaigns that used phishing emails for initial access, established persistence via registry Run keys or scheduled tasks, downloaded payloads from remote locations, collected sensitive information, and exfiltrated the data via Telegram. To evade detection, we observed the use of legitimate services such as Telegram for command-and-control communications, obfuscated Python scripts, malicious DLLs being sideloaded, Python interpreter masquerading as a system process (i.e., svchost.exe), and the use of signed and living off the land binaries.

Due to the growing threat of Python-based infostealers, it is important that organizations protect their environment by being aware of the tactics, techniques, and procedures used by the threat actors who deploy this type of malware. Being compromised by infostealers can lead to data breaches, unauthorized access to internal systems, business email compromise (BEC), supply chain attacks, and ransomware attacks.

Attackers are weaponizing WhatsApp and PDF tools to spread infostealers

Since late 2025, platform abuse has become an increasingly prevalent tactic wherein adversaries deliberately exploit the legitimacy, scale, and user trust associated with widely used applications and services.

WhatsApp Abused to Deliver Eternidade Stealer: During November 2025, Microsoft Defender Experts identified a WhatsApp platform abuse campaign leveraging multi-stage infection and worm-like propagation to distribute malware. The activity begins with an obfuscated Visual Basic script that drops a malicious batch file launching PowerShell instances to download payloads.

One of the payloads is a Python script that establishes communication with a remote server and leverages WPPConnect to automate message sending from hijacked WhatsApp accounts, harvests the victim’s contact list, and sends malicious attachments to all contacts using predefined messaging templates. Another payload is a malicious MSI installer that ultimately delivers Eternidade Stealer, a Delphi-based credential stealer that continuously monitors active windows and running processes for strings associated with banking portals, payment services, and cryptocurrency exchanges including Bradesco, BTG Pactual, MercadoPago, Stripe, Binance, Coinbase, MetaMask, and Trust Wallet.

Malicious Crystal PDF installer campaign: In September 2025, Microsoft Defender Experts discovered a malicious campaign centered on an application masquerading as a PDF editor named Crystal PDF. The campaign leveraged malvertising and SEO poisoning through Google Ads to lure users. When executed, CrystalPDF.exe establishes persistence via scheduled tasks and functions as an information stealer, covertly hijacking Firefox and Chrome browsers to access sensitive files in AppData\Roaming, including cookies, session data, and credential caches.

Mitigation and protection guidance

Microsoft recommends the following mitigations to reduce the impact of the macOS‑focused, Python‑based, and platform‑abuse infostealer threats discussed in this report. These recommendations draw from established Defender blog guidance patterns and align with protections offered across Microsoft Defender XDR.

Organizations can follow these recommendations to mitigate threats associated with this threat:

Strengthen user awareness & execution safeguards

Educate users on social‑engineering lures, including malvertising redirect chains, fake installers, and ClickFix‑style copy‑paste prompts common across macOS stealer campaigns such as DigitStealer, MacSync, and AMOS.

Discourage installation of unsigned DMGs or unofficial “terminal‑fix” utilities; reinforce safe‑download practices for consumer and enterprise macOS systems.

Harden macOS environments against native tool abuse

Monitor for suspicious Terminal activity—especially execution flows involving curl, Base64 decoding, gunzip, osascript, or JXA invocation, which appear across all three macOS stealers.

Detect patterns of fileless execution, such as in‑memory pipelines using curl | base64 -d | gunzip, or AppleScript‑driven system discovery and credential harvesting.

Leverage Defender’s custom detection rules to alert on abnormal access to Keychain, browser credential stores, and cloud/developer artifacts, including SSH keys, Kubernetes configs, AWS credentials, and wallet data.

Control outbound traffic & staging behavior

Inspect network egress for POST requests to newly registered or suspicious domains—a key indicator for DigitStealer, MacSync, AMOS, and Python‑based stealer campaigns.

Detect transient creation of ZIP archives under /tmp or similar ephemeral directories, followed by outbound exfiltration attempts.

Block direct access to known C2 infrastructure where possible, informed by your organization’s threat‑intelligence sources.

Protect against Python-based stealers & cross-platform payloads

Harden endpoint defenses around LOLBIN abuse, such as certutil.exe decoding malicious payloads.

Evaluate activity involving AutoIt and process hollowing, common in platform‑abuse campaigns.

Microsoft also recommends the following mitigations to reduce the impact of this threat:

Turn on cloud-delivered protection in Microsoft Defender Antivirus or the equivalent for your antivirus product to cover rapidly evolving attacker tools and techniques. Cloud-based machine learning protections block a majority of new and unknown threats.

Run EDR in block mode so that Microsoft Defender for Endpoint can block malicious artifacts, even when your non-Microsoft antivirus does not detect the threat or when Microsoft Defender Antivirus is running in passive mode. EDR in block mode works behind the scenes to remediate malicious artifacts that are detected post-breach.

Enable network protection and web protection in Microsoft Defender for Endpoint to safeguard against malicious sites and internet-based threats.

Encourage users to use Microsoft Edge and other web browsers that support Microsoft Defender SmartScreen, which identifies and blocks malicious websites, including phishing sites, scam sites, and sites that host malware.

Allow investigation and remediation in full automated mode to allow Microsoft Defender for Endpoint to take immediate action on alerts to resolve breaches, significantly reducing alert volume.

Turn on tamper protection features to prevent attackers from stopping security services. Combine tamper protection with the DisableLocalAdminMerge setting to prevent attackers from using local administrator privileges to set antivirus exclusions.

Microsoft Defender XDR customers can also implement the following attack surface reduction rules to harden an environment against LOLBAS techniques used by threat actors:

Microsoft Defender XDR detections

Microsoft Defender XDR customers can refer to the list of applicable detections below. Microsoft Defender XDR coordinates detection, prevention, investigation, and response across endpoints, identities, email, and apps to provide integrated protection against attacks like the threat discussed in this blog.

Customers with provisioned access can also use Microsoft Security Copilot in Microsoft Defender to investigate and respond to incidents, hunt for threats, and protect their organization with relevant threat intelligence.

Tactic	Observed activity	Microsoft Defender coverage
Execution	Encoded powershell commands downloading payload Execution of various commands and scripts via osascript and sh	Microsoft Defender for Endpoint Suspicious Powershell download or encoded command execution Suspicious shell command execution Suspicious AppleScript activity Suspicious script launched
Persistence	Registry Run key created Scheduled task created for recurring execution LaunchAgent or LaunchDaemon for recurring execution	Microsoft Defender for Endpoint Anomaly detected in ASEP registry Suspicious Scheduled Task Launched Suspicious Pslist modifications Suspicious launchctl tool activity Microsoft Defender Antivirus Trojan:AtomicSteal.F
Defense Evasion	Unauthorized code execution facilitated by DLL sideloading and process injection Renamed Python interpreter executes obfuscated Python script Decode payload with certutil Renamed AutoIT interpreter binary and AutoIT script Delete data staging directories	Microsoft Defender for Endpoint An executable file loaded an unexpected DLL file A process was injected with potentially malicious code Suspicious Python binary execution Suspicious certutil activity Obfuse’ malware was prevented Rename AutoIT tool Suspicious path deletion Microsoft Defender Antivirus Trojan:Script/Obfuse!MSR
Credential Access	Credential and Secret Harvesting Cryptocurrency probing	Microsoft Defender for Endpoint Possible theft of passwords and other sensitive web browser information Suspicious access of sensitive files Suspicious process collected data from local system Unix credentials were illegitimately accessed
Discovery	System information queried using WMI and Python	Microsoft Defender for Endpoint Suspicious System Hardware Discovery Suspicious Process Discovery Suspicious Security Software Discovery Suspicious Peripheral Device Discovery
Command and Control	Communication to command and control server	Microsoft Defender for Endpoint Suspicious connection to remote service
Collection	Sensitive browser information compressed into ZIP file for exfiltration	Microsoft Defender for Endpoint Compression of sensitive data Suspicious Staging of Data Suspicious archive creation
Exfiltration	Exfiltration through curl	Microsoft Defender for Endpoint Suspicious file or content ingress Remote exfiltration activity Network connection by osascript

Threat intelligence reports

Microsoft customers can use the following reports in Microsoft products to get the most up-to-date information about the threat actor, malicious activity, and techniques discussed in this blog. These reports provide the intelligence, protection information, and recommended actions to prevent, mitigate, or respond to associated threats found in customer environments.

Microsoft Defender XDR Threat analytics

Hunting queries

Microsoft Defender XDR

Microsoft Defender XDR customers can run the following queries to find related activity in their networks:

Use the following queries to identify activity related to DigitStealer

// Identify suspicious DynamicLake disk image (.dmg) mounting 
DeviceProcessEvents 
| where FileName has_any ('mount_hfs', 'mount') 
| where ProcessCommandLine has_all ('-o nodev' , '-o quarantine') 
| where ProcessCommandLine contains '/Volumes/Install DynamicLake' 

 
// Identify data exfiltration to DigitStealer C2 API endpoints. 
DeviceProcessEvents 
| where InitiatingProcessFileName has_any ('bash', 'sh') 
| where ProcessCommandLine has_all ('curl', '--retry 10') 
| where ProcessCommandLine contains 'hwid=' 
| where ProcessCommandLine endswith "api/credentials" 
        or ProcessCommandLine endswith "api/grabber" 
        or ProcessCommandLine endswith "api/log" 
| extend APIEndpoint = extract(@"/api/([^\s]+)", 1, ProcessCommandLine)

Use the following queries to identify activity related to MacSync

// Identify exfiltration of staged data via curl 
DeviceProcessEvents 
| where InitiatingProcessFileName =~ "zsh" and FileName =~ "curl" 
| where ProcessCommandLine has_all ("curl -k -X POST -H", "api-key: ", "--max-time", "-F file=@/tmp/", ".zip", "-F buildtxd=")

Use the following queries to identify activity related to Atomic Stealer (AMOS)

// Identify suspicious AlliAi disk image (.dmg) mounting  
DeviceProcessEvents  
| where FileName has_any ('mount_hfs', 'mount') 
| where ProcessCommandLine has_all ('-o nodev', '-o quarantine')  
| where ProcessCommandLine contains '/Volumes/ALLI'

Use the following queries to identify activity related to PXA Stealer: Campaign 1

// Identify activity initiated by renamed python binary 
DeviceProcessEvents 
| where InitiatingProcessFileName endswith "svchost.exe" 
| where InitiatingProcessVersionInfoOriginalFileName == "pythonw.exe" 

// Identify network connections initiated by renamed python binary 
DeviceNetworkEvents 
| where InitiatingProcessFileName endswith "svchost.exe" 
| where InitiatingProcessVersionInfoOriginalFileName == "pythonw.exe"

Use the following queries to identify activity related to PXA Stealer: Campaign 2

// Identify malicious Process Execution activity 
DeviceProcessEvents 
 | where ProcessCommandLine  has_all ("-y","x",@"C:","Users","Public", ".pdf") and ProcessCommandLine  has_any (".jpg",".png") 

// Identify suspicious process injection activity 
DeviceProcessEvents 
 | where FileName == "cvtres.exe" 
 | where InitiatingProcessFileName has "svchost.exe" 
 | where InitiatingProcessFolderPath !contains "system32"

Use the following queries to identify activity related to WhatsApp Abused to Deliver Eternidade Stealer

// Identify the files dropped from the malicious VBS execution 
DeviceFileEvents 
| where InitiatingProcessCommandLine has_all ("Downloads",".vbs") 
| where FileName has_any (".zip",".lnk",".bat") and FolderPath has_all ("\\Temp\\") 

// Identify batch script launching powershell instances to drop payloads 
DeviceProcessEvents 
| where InitiatingProcessParentFileName == "wscript.exe" and InitiatingProcessCommandLine  has_any ("instalar.bat","python_install.bat") 
| where ProcessCommandLine !has "conhost.exe" 
 
// Identify AutoIT executable invoking malicious AutoIT script 
DeviceProcessEvents 
| where InitiatingProcessCommandLine   has ".log" and InitiatingProcessVersionInfoOriginalFileName == "Autoit3.exe"

Use the following queries to identify activity related to Malicious CrystalPDF Installer Campaign

// Identify network connections to C2 domains 
DeviceNetworkEvents 
| where InitiatingProcessVersionInfoOriginalFileName == "CrystalPDF.exe" 

// Identify scheduled task persistence 
DeviceEvents 
| where InitiatingProcessVersionInfoProductName == "CrystalPDF" 
| where ActionType == "ScheduledTaskCreated

Indicators of compromise

Indicator	Type	Description
3e20ddb90291ac17cef9913edd5ba91cd95437da86e396757c9d871a82b1282a da99f7570b37ddb3d4ed650bc33fa9fbfb883753b2c212704c10f2df12c19f63	SHA-256	Payloads related to DigitStealer campaign
42d51feea16eac568989ab73906bbfdd41641ee3752596393a875f85ecf06417	SHA-256	Payload related to Atomic Stealer (AMOS)
2c885d1709e2ebfcaa81e998d199b29e982a7559b9d72e5db0e70bf31b183a5f 6168d63fad22a4e5e45547ca6116ef68bb5173e17e25fd1714f7cc1e4f7b41e1 3bd6a6b24b41ba7f58938e6eb48345119bbaf38cd89123906869fab179f27433 5d929876190a0bab69aea3f87988b9d73713960969b193386ff50c1b5ffeadd6  bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1 495697717be4a80c9db9fe2dbb40c57d4811ffe5ebceb9375666066b3dda73c3 de07516f39845fb91d9b4f78abeb32933f39282540f8920fe6508057eedcbbea	SHA-256	Payloads related to WhatsApp malware campaign
598da788600747cf3fa1f25cb4fa1e029eca1442316709c137690e645a0872bb 3bc62aca7b4f778dabb9ff7a90fdb43a4fdd4e0deec7917df58a18eb036fac6e c72f8207ce7aebf78c5b672b65aebc6e1b09d00a85100738aabb03d95d0e6a95	SHA-256	Payloads related to Malicious Crystal PDF installer campaign
9d867ddb54f37592fa0ba1773323e2ba563f44b894c07ebfab4d0063baa6e777 08a1f4566657a07688b905739055c2e352e316e38049487e5008fc3d1253d03b 5970d564b5b2f5a4723e548374d54b8f04728473a534655e52e5decef920e733 59855f0ec42546ce2b2e81686c1fbc51e90481c42489757ac03428c0daee6dfe a5b19195f61925ede76254aaad942e978464e93c7922ed6f064fab5aad901efc e7237b233fc6fda614e9e3c2eb3e03eeea94f4baf48fe8976dcc4bc9f528429e 59347a8b1841d33afdd70c443d1f3208dba47fe783d4c2015805bf5836cff315 e965eb96df16eac9266ad00d1087fce808ee29b5ee8310ac64650881bc81cf39	SHA-256	Payloads related to PXA Stealer: Campaign 1
hxxps://allecos[.]de/Documentación_del_expediente_de_derechos_de_autor_del_socio.zip	URL	Used to deliver initial access ZIP file (PXA Stealer: Campaign 1)
hxxps://bagumedios[.]cloud/assets/media/others/ADN/pure	URL	Used to deliver PureRAT payload (PXA Stealer: Campaign 1)
hxxp://concursal[.]macquet[.]de/uid_page=244739642061129 hxxps://tickets[.]pfoten-prinz[.]de/uid_page=118759991475831	URL	URL contained in phishing email (PXA Stealer: Campaign 1)
hxxps://erik22[.]carrd.co	URL	Used in make network connection and subsequent redirection in (PXA Stealer: Campaign 2)
hxxps://erik22jomk77[.]card.co	URL	Used in make network connection and subsequent redirection in (PXA Stealer: Campaign 2)
hxxps[:]//empautlipa[.]com/altor/installer[.]msi	URL	Used to deliver VBS initial access payload (WhatsApp Abused to Deliver Eternidade Stealer)
217.119.139[.]117	IP Address	AMOS C2 server (AMOS campaign)
157[.]66[.]27[.]11	IP Address	PureRAT C2 server (PXA Stealer: Campaign 1)
195.24.236[.]116	IP Address	C2 server (PXA Stealer: Campaign 2)
dynamiclake[.]org	Domain	Deceptive domain used to deliver unsigned disk image. (DigitStealer campaign)
booksmagazinetx[.]com goldenticketsshop[.]com	Domain	C2 servers (DigitStealer campaign)
b93b559cf522386018e24069ff1a8b7a[.]pages[.]dev 67e5143a9ca7d2240c137ef80f2641d6[.]pages[.]dev	Domain	CloudFlare Pages hosting payloads. (DigitStealer campaign)
barbermoo[.]coupons barbermoo[.]fun barbermoo[.]shop barbermoo[.]space barbermoo[.]today barbermoo[.]top barbermoo[.]world barbermoo[.]xyz	Domain	C2 servers (MacSync Stealer campaign)
alli-ai[.]pro	Domain	Deceptive domain that redirects user after CAPTCHA verification (AMOS campaign)
ai[.]foqguzz[.]com	Domain	Redirected domain used to deliver unsigned disk image. (AMOS campaign)
day.foqguzz[.]com	Domain	C2 server (AMOS campaign)
bagumedios[.]cloud	Domain	C2 server (PXA Stealer: Campaign 1)
Negmari[.]com Ramiort[.]com Strongdwn[.]com	Domain	C2 servers (Malicious Crystal PDF installer campaign)

Microsoft Sentinel

Microsoft Sentinel customers can use the TI Mapping analytics (a series of analytics all prefixed with ‘TI map’) to automatically match the malicious domain indicators mentioned in this blog post with data in their workspace. If the TI Map analytics are not currently deployed, customers can install the Threat Intelligence solution from the Microsoft Sentinel Content Hub to have the analytics rule deployed in their Sentinel workspace.

References

This research is provided by Microsoft Defender Security Research with contributions from Felicia Carter, Kajhon Soyini, Balaji Venkatesh S, Sai Chakri Kandalai, Dietrich Nembhard, Sabitha S, and Shriya Maniktala.