Mac users warned about new DigitStealer information stealer

A new infostealer called DigitStealer is going after Mac users, with researchers describing it as having advanced detection evasion, a multi‑stage attack chain and platform‑specific targeting. The variant is fileless in operation and limits itself to newer ARM hardware while skipping older Intel Macs and most virtual machines.

The attack starts with a file disguised as a utility app called “DynamicLake” hosted on a fake website, which instructs users to drag a file into Terminal to initiate the download and installation. Its initial payload attempts to harvest passwords and steal documents, notes, and files before uploading them to the attackers’ servers, while the second stage targets browser information from Chrome, Brave, Edge, Firefox and others, as well as keychain passwords, crypto wallets, VPN configurations and Telegram sessions.

Malwarebytes detects DigitStealer on Mac as MacOA.Stealer[.]DigitSteal and notes the fileless nature of the attack leaves few traces, complicating detection and remediation. Posted: 19 November 2025.