macOS Malware Campaigns Shift Toward Infostealers and Social Engineering to Bypass Apple Protections

Threat actors are increasingly targeting macOS users with infostealers and distribution-as-a-service models, reflecting a broader “gold rush” in Apple-focused malware development. Reporting highlights macOS stealers targeting browser credentials and cryptocurrency assets (including seed phrases) and notes tactics to evade Apple controls such as obtaining valid Apple developer signatures to bypass Gatekeeper; one cited example is MacSync being notarized and signed under Team ID GNJLS3UYZ4. The same reporting describes ecosystem-scale enablement, including large-scale compromise of WordPress sites for distribution and novel command-and-control approaches such as using blockchain smart contracts (e.g., on BNB Smart Chain), alongside paid-traffic abuse (e.g., promoting malicious AI chat content via ads) to push stealer payloads.

Separately, a Darktrace-described investigation details a multi-stage macOS malware campaign that prioritizes social engineering over exploitation to defeat Apple’s Transparency, Consent, and Control (TCC) privacy framework. Victims are lured via phishing to open an AppleScript masquerading as a document (Confirmation_Token_Vesting.docx.scpt), which displays a fake “Compatibility” error and instructs the user to launch a “Compatibility Wizard” (e.g., using a keyboard shortcut) that effectively tricks them into authorizing execution and granting access. Together, the reporting indicates macOS threats are increasingly succeeding by combining credential/crypto theft objectives with user-prompt manipulation and trust-abuse techniques rather than relying on kernel or sandbox escapes.