Advanced macOS DigitStealer Targets M2+ Macs, Hijacking Ledger Live via JXA and DNS-Based C2

Advanced macOS DigitStealer targets M2+ Macs, hijacking Ledger Live via JXA and DNS-based C2, with researchers flagging a high level of sophistication and platform awareness. The malware is packaged as an unsigned disk image named DynamicLake.dmg and masquerades as the legitimate DynamicLake macOS utility, distributed via the domain dynamiclake[.]org, and it relies on Cloudflare Pages hosting for parts of its delivery.

Initial infection uses a drag-to-terminal script that fetches the first payload from a remote URL, followed by a multi-stage approach that includes an AppleScript for credential harvesting and a separate JavaScript for Automation payload to extract browser data, wallet details, macOS Keychain, VPN configurations and Telegram data. The campaign targets Ledger Live by modifying its configuration to point to an attacker-controlled endpoint, enabling exfiltration of seed phrases or insertion of malicious wallet data.

A final stage establishes persistence through a Launch Agent that retrieves further payloads from a DNS TXT record and a long-running JXA agent that polls the attacker’s C2 server every 10 seconds, reporting the system’s hardware UUID hashed with MD5. According to Jamf Threat Labs, the DigitStealer campaign shows growing sophistication in macOS threat development and demonstrates how threat actors abuse legitimate hosting and distribution methods to bypass controls.