For too long, macOS users have operated under the myth of inherent security. KELA's own research shows how quickly that assumption expired: macOS infostealer infections rose from fewer than 1,000 in 2024 to more than 70,000 in 2025, an increase of roughly 7,000%. macOS remains a small share of total infostealer activity next to Windows, but no other platform grew at anything close to that rate. Highly motivated threat actors and the booming Malware-as-a-Service (MaaS) economy have shattered the illusion, creating sophisticated infostealers that aggressively target developers and enterprises.

These threats leverage native macOS features like Keychain Services and exploit supply chain weaknesses to steal valuable cloud tokens and credentials. The consequence is not just a lost password, but the compromise of your core infrastructure. In this blog, we will dissect the characteristics of these modern threats, detail the most effective prevention strategies, and outline a robust incident response framework.

» Try KELA's cyber threat intelligence for free

What Are macOS Infostealers?

These threats can collect data from multiple areas of a Mac, including web browsers, password managers, cryptocurrency wallets, and system files, potentially giving attackers access to credentials, financial information, and other sensitive data. For scale, KELA observed approximately 3.9 million unique infected machines across all platforms in 2025, yielding 347.5 million compromised credentials, part of 2.86 billion compromised credentials tracked across the wider cybercrime ecosystem that year.

Key Characteristics of Modern macOS Infostealers

KELA analyzed threat actor chatter across dark web forums, marketplaces and Telegram channels from January 2022 to December 2025, tracking both actors shopping for macOS-targeting infostealers and actors advertising them. Buyer demand rose roughly tenfold over that period and hit an all-time high in 2025. Supply moved with it.

• Sophisticated use of native macOS features: These stealers exploit built-in tooling for their operations, such as the Keychain Services API to access stored passwords and keys, and the AppleScript framework for execution and prompting users for credentials.
• Layered technical evasion: They employ sophisticated techniques to hide their code, including multiple layers of obfuscation (e.g., XOR decryption and complex control flow) to impede static analysis by traditional security tools.
• Use of packaging tools for stealth: Many utilize packaging tools like PyInstaller to wrap the malicious code into large, legitimate-looking binaries, which effectively lowers the likelihood of detection by security software.

» Here's everything you need to know about infostealers

Distribution Methods and Attack Vectors

Delivering these payloads requires targeted social engineering and manipulated delivery channels designed to exploit standard developer and enterprise workflows.

• Malicious Search Engine Optimization (SEO) poisoning: Threat actors construct convincing fake project repositories and mirror sites, pushing them to the top of search engine rankings to trick users into downloading trojanized productivity tools or code libraries.
• Malvertising and targeted spam: Campaigns frequently leverage paid search ads and malicious email outreach to drive traffic directly toward fake download portals.
• Exploitation of implicit trust: Attackers disguise stealers as legitimate applications, often using public hosting platforms such as GitHub Pages as an initial redirection point.
• Software supply chain infiltration: Attackers inject malicious dependencies and typosquatted packages into public registries, ensuring that routine dependency installs trigger automated post-install payload execution.

How far the barrier has fallen is visible in the market itself. On December 29, 2025, KELA observed a post on the ExploitIn forum from an actor seeking a "direct link" macOS stealer that would work from a single victim click, explicitly to avoid the technical work of privilege escalation or bypassing Gatekeeper. The phrasing points to an entry-level buyer, which is the whole proposition of Malware-as-a-Service: you no longer need to understand the platform you are attacking.

On the same day, on the RAMP forum, an actor using the handle Mr_Stuxnot advertised Atlas macOS Stealer 2026 for targeted spear-phishing campaigns. The listing claimed support for both Intel and Apple Silicon, harvesting of browser credentials, session tokens, payment cards and cryptocurrency wallets, keychain phishing, credential decryption, a polymorphic encrypted Bash dropper built for ClickFix campaigns, encrypted reverse-shell persistence, and cloud-based exfiltration.

» Read more: The rise of macOS infostealers in 2025

Two Active macOS Infostealer Families

1. Atomic Stealer (AMOS)

Active since April 2023, Atomic Stealer is sold as Malware-as-a-Service on Telegram and hacker forums. It evolved from Go binaries into C++ and Python-based builds and is known for broad theft capabilities, including browser credentials, cryptocurrency wallets, and data from Telegram and Discord.

2. Quark Stealer

A cross-platform stealer sold for both macOS and Windows, marketed with the trappings of a legitimate software business: SaaS-style promotion, dedicated Telegram support, and published changelogs. The packaging is the point. It signals a market mature enough to compete on customer experience rather than on capability alone.

» Here are the most targeted entry points by hackers

Categories of Sensitive Data Targeted

macOS infostealers are built for maximum data collection and immediate monetization, targeting four principal categories of sensitive information:

• Authentication and system credentials: They obtain passwords via Keychain Services API, browser managers, and password managers like BitWarden. Advanced variants extract SSH private keys and cloud tokens such as AWS credentials.
• Financial and crypto assets: They target cryptocurrency wallets, payment card details, and stored banking information.
• Application and session data: They harvest active session tokens, including browser cookies that bypass MFA, and tokens for apps such as Telegram or Discord.
• Data harvested during cleanup operations: Stealers scan for sensitive files like macOS Notes and office or image documents (.pdf, .doc, .png).

» Learn more: How scary is that data leak, really?

Practical Recommendations and Operationalizing Defense

Measuring Security Posture and Incident Response Effectiveness

Defending against macOS infostealers requires organizations to look beyond basic endpoint logging and assess how well their security controls detect threats, protect critical systems, and respond to incidents. A strong security posture can be measured across several key areas:

• Attack technique coverage: Assess whether security controls can identify macOS-specific techniques used for malicious execution, credential theft, and unauthorized access.
• Response and remediation speed: Track how quickly threats are detected, contained, credentials are revoked, and affected systems are secured to limit the impact of an incident.
• Developer environment security: Regularly audit developer workstations, software dependencies, and access permissions to identify weaknesses that could lead to an initial compromise or wider supply chain attack.
• Supply chain visibility: Monitor third-party software, dependencies, and development tools for signs of compromise before they introduce risk into the wider environment.

» Discover how supply chain threat intelligence strengthens your security posture

Resources and Timeline for Comprehensive Protection

A comprehensive macOS infostealer protection program requires a layered approach involving technology investments and rapid implementation, given the escalating threat landscape.

Required resources and focus

• Technology investment: This includes adopting Endpoint Detection and Response (EDR) solutions configured with behavioral monitoring for macOS activities, as well as pipeline supply chain security tools ( for auditing dependencies.
• Implementation urgency: Given the rapidly worsening threat landscape, security measures should be rolled out promptly to protect against new macOS infostealer threats.
• Immediate action priority: Upon detecting a suspected breach, the utmost priority must be the rapid revocation and rotation of any potentially compromised credentials and tokens.

» Make sure you understand the difference between leaked credentials and compromised accounts

Behavioral Detection and Monitoring Approach

Leading organizations rely on behavioral telemetry and machine learning integrated into security solutions to detect infostealer operations by focusing on Tactics, Techniques, and Procedures (TTPs) rather than just file hashes.

This impacts monitoring across three critical areas:

1. Script execution analytics: Continuously analyze and flag anomalous use of osascript, which threat actors abuse to trigger payloads in new terminal windows, bypassing standard installation process checks.
2. Credential access analytics: Look for and immediately alert on anomalous file access patterns targeting sensitive locations like Keychain Services API.
3. Data collection analytics: Detect access patterns indicative of sweeping browser data (e.g., passwords, cookies) and configuration files for tokens (e.g., AWS, GitHub tokens).

» Understand how threat actors breach and exploit your data

Controls and Practices Leading to Better Outcomes

Actions for prevention depend completely on dealing with the primary vector of supply chain attacks, as seen in campaigns leveraging npm typosquatted packages.

Such organizations should continuously audit dependencies using supply chain inspection tools to inspect packages at the time of installation and block anomalies before they can compromise a project.

On top of that, critical security controls include:

• MFA enforcement: Require multi-factor authentication on all accounts. Stolen session cookies can bypass MFA entirely, but MFA still blocks the far more common case of a password replayed without a live session.
• Network filtering: Deployment of network filtering services to identify and block connections to malicious command-and-control infrastructures.
• Rapid remediation plan: Pre-planning for rapid and thorough credential revocation following a compromise, including resetting all keyrings, rotating SSH keys, and revoking tokens that permit programmatic access to cloud resources and repositories.

Incident Response Structure for Compromises

Once a compromise is detected, the response needs to move quickly from identifying the threat to fully invalidating compromised credentials. Because these threats can steal authentication tokens and system keyrings, attackers may gain ongoing programmatic access to systems and infrastructure. As a result, organizations should treat any system accessed by the compromised credentials as potentially affected.

The response should focus on three immediate priorities:

• Revoke and rotate credentials: Reset credentials stored in system keyrings and password managers as soon as possible. Revoke compromised OAuth tokens, JWTs, and API keys, and rotate SSH keys to prevent attackers from maintaining access to code repositories, cloud environments, or other connected systems.
• Detect and investigate the scope: Use security monitoring and detection tools to identify suspicious credential-access activity and script execution patterns. Review authentication and access logs for signs of lateral movement, and correlate them with network logs to identify connections to known command-and-control (C2) infrastructure.
• Harden affected systems: Enforce multi-factor authentication (MFA) wherever possible and remove any persistence mechanisms that may have been installed by the malware. Continue monitoring affected systems to ensure unauthorized access has been fully eliminated.

» Find out how to detect password leaks and breached credentials

Evaluating macOS Security

Organizations should evaluate security solutions based on how effectively they address macOS-specific attack techniques, rather than relying solely on traditional signature-based detection.

How to Choose the Right macOS Security Solution

Look for solutions that use client-side or server-side machine learning to identify suspicious activity, including threats that may not match known malware signatures.

The strongest solutions should also provide macOS-specific visibility and detection capabilities tailored to the techniques attackers commonly use on Apple devices. Here are some key features to look for:

• macOS-specific detection: Look for analytics designed around common macOS attack techniques. This should include AppleScript monitoring to detect suspicious use of the osascript utility and credential-access analytics to identify unusual attempts to access Keychain Services.
• Pre-execution and supply chain protection: Security tools should be able to analyze software before it runs and scan dependencies for potential threats. This is particularly important for detecting supply chain attacks (T1195.002), where attackers distribute compromised or trojanized installers.
• Network protection: DNS and URL layer filtering can help detect and block connections to known malicious command-and-control (C2) infrastructure, limiting an attacker's ability to communicate with compromised systems.

» Understand why you need cyber threat intelligence for your organization

Cyber Threat Intelligence

Discover how KELA helps you detect, respond, and protect against macOS infostealer attacks.

Learn More

Common macOS Security Gaps to Watch For

To effectively counter the evolving threat landscape, organizations must avoid common pitfalls that leave them vulnerable to sophisticated macOS infostealers.

Relying Too Heavily on Known Threat Signatures

• The mistake: Traditional signature-based detection can struggle against malware that is heavily obfuscated or frequently modified. For example, tools such as the data_extractor binary have been observed using multiple layers of obfuscation, including XOR-based decryption, making static indicators easier for attackers to change or conceal.
• How to avoid: A stronger approach is to use behavioral detection alongside signature matching. Instead of looking only for a known file hash, behavioral detection can flag suspicious activity such as unusual API calls, access to sensitive files, or abnormal attempts to retrieve credentials.

Leaving Developer Macs Under-Protected

• The mistake: Developer workstations deserve particular attention because they often provide access to sensitive development and cloud environments. A single compromised machine may expose SSH keys, cloud API keys, source-code repositories, and other credentials that attackers can use in supply chain attacks or to move deeper into the organization.
• The credential data bears this out. Across KELA's 2025 dataset, business cloud platforms accounted for 19.6% of compromised credentials, user authentication services for 12.9%, and version control systems for 8.9%. Together with CMS platforms and email, those five categories made up over 75% of the total. They are also, almost exactly, the list of services a developer's Mac holds live tokens for.
• How to avoid: These endpoints should therefore be treated as high-value assets. Apply least-privilege access, continuously audit installed software and dependencies, use conditional access controls, and require MFA for access to critical systems. Regularly reviewing what developers can access also helps reduce the impact if a workstation is compromised.

Ignoring Native Persistence Threats

• The mistake: Organizations often focus solely on the initial compromise, ignoring how quickly native macOS persistence mechanisms are maturing. This allows threat actors to establish long-term access by utilizing stolen active session cookies (T1539) and critical developer tokens (OAuth/JWT) to pivot from the endpoint directly into corporate cloud infrastructure.
• How to avoid: Implement proactive monitoring for the installation of new persistence mechanisms and utilize EDR to enforce a Zero Trust principle. Crucially, enforce session revocation policies and frequently rotate all developer tokens and keys to neutralize long-term backdoor access.

» Read more in KELA’s full macOS infostealer report for case studies, timelines, and real underground market insights

Strengthening Your Defense with Intelligence

What Happens After the Mac Is Infected: Endpoint controls only cover endpoints you manage. A significant share of macOS infostealer infections land on machines an enterprise cannot instrument: contractor laptops, personal Macs used for work, and third-party developers holding repository access. Behavioral detection on your own fleet will not see any of them, and the credentials stolen from those machines open your systems just as effectively.

Stolen macOS credentials do not sit idle. KELA's researchers observed a $3,500 underground listing for VPN access to a U.S. industrial firm, which is what the end of this chain looks like in practice: one infected machine, one set of harvested credentials, and a priced, packaged route into a corporate network offered to whoever wants it. What is observable in those cases is the output. Credentials, session cookies and tokens harvested from a Mac are packaged and sold, either as listings in cybercrime forums or through markets that trade access to a single infected device. Monitoring those sources for your own domains, applications and cloud tenants tells you a machine you do not control has been compromised, often before the credential is used against you. This is where KELA's Monitor module sits. Its Leaked Credentials incidents surface client emails and passwords extracted from databases traded in KELA's sources, and its Hacking Discussions incidents surface mentions of your assets in raw data collected from darknet forums, markets and paste sites, with targeted alerts in real time.

We at KELA Cyber help your organization achieve this proactive stance by leveraging our threat intelligence and darknet monitoring capabilities. By infiltrating underground criminal channels, we provide real-time, actionable insight into emerging Malware-as-a-Service threats and the credentials they put up for sale, allowing your security team to act before an exposure reaches your business.

» Ready to begin? Contact us to learn more or try KELA for free