Stealers on the Rise: A Closer Look at a Growing macOS Threat
Summary: Unit 42 identified three prevalent macOS infostealers in the wild - Atomic Stealer (AMOS), Poseidon Stealer and Cthulhu Stealer - and reported a 101% increase in macOS infostealer detections in its telemetry between the last two quarters of 2024. Infostealers accounted for the largest group of new macOS malware in 2024, with operators distributing them through malvertising, Google ads, malicious spam and Trojanized installers that use AppleScript prompts to capture credentials.
Key Takeaway: Infostealers are often dismissed as low-level because their functionality is narrower than a remote access Trojan, but the credentials and financial data they exfiltrate frequently become the entry point for later ransomware deployment. A 101% quarter-over-quarter jump in detections means the macOS endpoints many organizations treat as low-risk are now a growth market for attackers selling malware as a service on Telegram and hacker forums.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026