Infostealers without borders: macOS, Python stealers, and platform abuse

Summary

Infostealer campaigns are no longer Windows-only: they increasingly target macOS, rely on cross-platform languages like Python, and abuse trusted platforms such as WhatsApp and PDF tools. Adversaries spread macOS stealers like DigitStealer, MacSync, and AMOS through fake DMGs and click-fix prompts, while Python stealers such as PXA Stealer arrive via phishing emails. These operations harvest credentials, cryptocurrency wallet data, and developer secrets, then exfiltrate them to attacker-controlled servers. Detection is harder due to fileless execution, signed binaries, and use of legitimate services for C2.

Investigation

Microsoft Defender researchers tracked multiple waves from late 2025 through 2026, collecting hashes, URLs, domains, and IPs tied to the activity. They documented persistence methods (registry Run keys, scheduled tasks, LaunchAgents), fileless execution via curl and AppleScript, and C2 over Telegram and other services. The write-up also provides sample KQL queries to surface suspicious endpoint and network signals.

Mitigation

Mitigations emphasize user training, blocking unsigned DMG installers, and monitoring for risky terminal chains using curl, base64, gunzip, or osascript. Enforce endpoint protections against LOLBIN abuse and restrict outbound traffic strictly to known malicious domains. Expand detections for registry Run keys, scheduled tasks, and process-injection patterns associated with stealers.

Response

When detected, isolate the endpoint, terminate malicious processes, remove persisted artifacts (registry keys, scheduled tasks), and block C2 infrastructure. Run forensics to determine what was stolen, reset compromised credentials, and notify affected users. Deploy refreshed detection rules and enable block-mode EDR to stop repeat infections.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:
  An attacker with local admin rights prepares a malicious payload. First, they copy the legitimate pythonw.exe to a new file named svchost.exe in a user‑writable directory (e.g., %TEMP%). They then embed an obfuscated Python script that exfiltrates credentials. Finally, they execute the renamed interpreter, which generates a process‑creation event where the process name is svchost.exe but the version‑info still reports pythonw.exe. This exact pattern matches the Sigma rule.

• Regression Test Script:

  #----------------------------------------------
  # Stage 1 – Prepare malicious svchost.exe copy
  #----------------------------------------------
  $tempDir = "$env:TEMPmalicious"
  New-Item -ItemType Directory -Path $tempDir -Force | Out-Null
  
  $src = "$env:ProgramFilesPython311pythonw.exe"   # adjust path to existing pythonw.exe
  $dst = "$tempDirsvchost.exe"
  Copy-Item -Path $src -Destination $dst -Force
  
  #----------------------------------------------
  # Stage 2 – Create obfuscated Python payload
  #----------------------------------------------
  $payload = @"
  import base64, subprocess, sys
  cmd = base64.b64decode('cHV0cyAtcGFzc3dvcmQgZXhhbXBsZQ==').decode()
  subprocess.run(cmd, shell=True)
  "@
  $payloadPath = "$tempDirpayload.py"
  $payload | Set-Content -Path $payloadPath -Encoding UTF8
  
  #----------------------------------------------
  # Stage 3 – Execute malicious svchost.exe (pythonw)
  #----------------------------------------------
  Start-Process -FilePath $dst -ArgumentList "`"$payloadPath`""
  
  #----------------------------------------------
  # Stage 4 – Optional: wait for detection ingestion
  #----------------------------------------------
  Start-Sleep -Seconds 10

• Cleanup Commands:

  # Remove malicious artifacts
  Remove-Item -Path "$env:TEMPmalicious" -Recurse -Force