Advanced macOS DigitStealer Uses Multi-Stage Attack Chain to Evade Detection

According to Jamf Threat Labs, a new macOS malware family tracked as DigitStealer represents a significant evolution in macOS-targeted threats, using a four-stage, multi-stage attack chain to evade detection. The campaign begins with an unsigned disk image named DynamicLake.dmg—hosted on dynamiclake[.]org and containing a dropper that overrides macOS Gatekeeper protections via a drag-to-terminal technique, while the legitimate version signs with Developer Team ID XT766AV9R9 is not used in the malicious variant.

Stage One deploys a base dropper that retrieves an obfuscated base64 script and performs extensive anti-analysis checks, including VM and debugger detection and Apple Silicon device feature checks, with geolocation filtering that can terminate on certain locales.

Stages Two through Four execute payloads in memory: an AppleScript infostealer that harvests credentials and data from browsers, keychains and cryptocurrency wallets, followed by a JavaScript for Automation payload with crypto-focused capabilities, and a multi-part Ledger Live compromise that concatenates components to recreate app[.]asar.

The final stage establishes persistence via a Launch Agent and increasingly devices commands from TXT records on the attacker’s server, with polling roughly every ten seconds and MD5-hashed hardware UUID reporting.