{“lastseen”:”2025-11-19T18:05:07″,”description”:”A new infostealer called DigitStealer is going after Mac users. It avoids detection, skips older devices, and steals files, passwords, and browser data. We break down what it does and how to protect your Mac.\\n\\n* * *\\n\\nResearchers have described a new malware called DigitStealer that steals sensitive information from macOS users.\\n\\nThis variant comes with advanced detection-evasion techniques and a multi-stage attack chain. Most infostealers go after the same types of data and use similar methods to get it, but DigitStealer is different enough to warrant attention.\\n\\nA few things make it stand out: platform-specific targeting, fileless operation, and anti-analysis techniques. Together, they pose relatively new challenges for Mac users.\\n\\nThe attack starts with a file disguised as a utility app called \\”DynamicLake,\\” which is hosted on a fake website rather than the legitimate company’s site. To trick users, it instructs you to drag a file into Terminal, which will initiate the download and installation of DigitStealer.\\n\\nIf your system matches certain regions or is a virtual machine, the malware won\u2019t run. That’s likely to hinder analysis by researchers and to steer clear of infecting people in its home country, which is enough in some countries to stay out of prison. It also limits itself to devices with newer ARM features introduced with M2 chips or later. chips, skipping older Macs, Intel-based chips, and most virtual machines.\\n\\nThe attack chain is largely fileless so it won\u2019t leave many traces behind on an affected machine. Unlike file-based attacks that execute the payload in the hard drive, fileless attacks execute the payload in Random Access Memory (RAM). Running malicious code directly in the memory instead of the hard drive has several advantages for attackers:\\n\\n * **Evasion of traditional security measures:** Fileless attacks bypass antivirus software and file-signature detection, making them harder to identify using conventional security tools. \\n * **Harder to remediate:** Since fileless attacks don\u2019t create files, they can be more challenging to remove once detected. This can make it extra tricky for forensics to trace an attack back to the source and restore the system to a secure state.\\n\\n\\n\\nDigitStealer\u2019s initial payload asks for your password and tries to steal documents, notes, and files. If successful, it uploads them to the attackers\u2019 servers.\\n\\nThe second stage of the attack goes after browser information from Chrome, Brave, Edge, Firefox and others, as well as keychain passwords, crypto wallets, VPN configurations (specifically OpenVPN and Tunnelblick), and Telegram sessions.\\n\\n## How to protect your Mac\\n\\nDigitStealer shows how Mac malware keeps evolving. It’s different from other infostealers, splitting its attack into stages, targeting new Mac hardware, and leaving barely any trace.\\n\\nBut you can still protect yourself:\\n\\n * Use an up-to-date real-time anti-malware solution. DigitStealer highlights the need for advanced behavioral protection, not just signature scans. Malwarebytes for Mac detects DigitStealer as **MacOA.Stealer.DigitSteal**.\\n\\n\\n\\n * Always be careful what you run in Terminal. Don\u2019t follow instructions from unsolicited messages.\\n * Be careful where you download apps from.\\n * Keep your software, especially your operating system and your security defenses, up to date.\\n * Turn on multi-factor authentication so a stolen password isn\u2019t enough to break into your accounts.\\n\\n\\n\\n* * *\\n\\n**We don\u2019t just report on threats\u2014we remove them**\\n\\nCybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.”,”published”:”2025-11-19T16:23:38″,”modified”:”2025-11-19T16:23:38″,”type”:”malwarebytes”,”title”:”Mac users warned about new DigitStealer information stealer”,”source”:””,”references”:””,”id”:”MALWAREBYTES:8ADD94EEC445B9294589A1C382A93B57″,”bulletinFamily”:”blog”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.malwarebytes.com\/blog\/news\/2025\/11\/mac-users-warned-about-new-digitstealer-information-stealer”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-11-19T18:05:07″,”description”:”A new infostealer called DigitStealer is going after Mac users. It avoids detection, skips older devices, and steals files, passwords, and browser data. We break…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,115,13,33,7,11,5],"class_list":["post-26860","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-malwarebytes","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n