Microsoft Warns: Python Infostealers Expand from Windows to macOS

Key Findings:

Microsoft warns that info-stealing attacks are "rapidly expanding" beyond Windows to target Apple macOS environments.
Attackers are leveraging cross-platform languages like Python and abusing trusted platforms to distribute infostealer malware at scale.

Since late 2025, Microsoft has observed macOS-targeted infostealer campaigns using social engineering techniques such as ClickFix-style prompts and malicious DMG installers.
These campaigns deploy macOS-specific infostealers like DigitStealer, MacSync, and Atomic macOS Stealer (AMOS) using fileless execution, native macOS utilities, and AppleScript automation.
The attacks harvest credentials, session data, and secrets from web browsers, keychains, and developer environments.

Python-based stealers are being leveraged by attackers to rapidly adapt, reuse code, and target heterogeneous environments with minimal overhead.
Malware like PXA Stealer, linked to Vietnamese-speaking threat actors, can harvest login credentials, financial information, and browser data.
Attackers have used phishing emails to distribute PXA Stealer, leveraging registry Run keys, scheduled tasks, and Telegram for persistence and command-and-control.

Bad actors have been observed weaponizing popular messaging apps like WhatsApp to distribute malware like Eternidade Stealer and gain access to financial and cryptocurrency accounts.
Fake PDF editors like Crystal PDF are also being distributed via malvertising and SEO poisoning to deploy Windows-based stealers that can steal cookies, session data, and credential caches.

Educate users on social engineering attacks like malvertising redirect chains, fake installers, and ClickFix-style copy-paste prompts.
Monitor for suspicious Terminal activity and access to the iCloud Keychain, and inspect network egress for POST requests to newly registered or suspicious domains.
Strengthen defenses against Python and LOLBIN abuse, enable cloud-delivered protection and EDR in block mode, and apply attack surface reduction rules.

https://thehackernews.com/2026/02/microsoft-warns-python-infostealers.html
https://securityaffairs.com/187608/security/microsoft-info-stealing-malware-expands-from-windows-to-macos.html
https://x.com/TheCyberSecHub/status/2018966095005356318
https://medium.com/@costigermano/microsoft-warns-python-infostealers-are-expanding-to-macos-through-fake-ads-and-installers-eda30b224507
https://www.thedailystar.net/tech-startup/news/infostealers-target-macos-fake-ads-and-installers-microsoft-says-4098001
https://www.cypro.se/2026/02/04/microsoft-warns-python-infostealers-target-macos-via-fake-ads-and-installers/