Mac Users Beware: New Malware Threatens Your Data

For years, Windows users have been the primary target for cybercriminals. However, a concerning trend is emerging: Macs are increasingly under attack. A surge in malware targeting macOS is putting personal data, cryptocurrency, and sensitive information at risk. Cybercriminals are leveraging artificial intelligence (AI) and sophisticated social engineering tactics to target Apple users, and some critics believe the company isn’t doing enough to address the growing threat.

One of the latest threats is a new Mac malware strain called FrigidStealer, which spreads through fake browser updates and compromised websites. This malware highlights the evolving tactics of cybercriminals and the need for Mac users to take proactive steps to protect their devices.

FrigidStealer: A Deep Dive

According to a report by cybersecurity firm Proofpoint, FrigidStealer is targeting macOS users through a campaign involving deceptive update scams. The malware is distributed through compromised websites that display fake browser update prompts. Unsuspecting users who click on these prompts unknowingly download a malicious DMG file, which is a common file format for installing software on macOS.

Once executed, FrigidStealer requests the user’s system password. This is a critical step, as it allows the malware to gain elevated privileges, granting it access to sensitive areas of the system. With these privileges, FrigidStealer can steal a wide range of information, including:

• Browser cookies: These files store information about your browsing activity, including login credentials, website preferences, and other personal data.
• Password-related files: These files may contain stored passwords for various applications and services.
• Cryptocurrency data: If you use your Mac to manage cryptocurrency wallets or exchanges, FrigidStealer can steal your private keys and other sensitive information, potentially leading to the loss of your digital assets.
• Apple Notes: The malware can access and steal notes stored in the Apple Notes application, which may contain personal thoughts, financial information, or other sensitive details.

Proofpoint has identified two new threat actors behind the FrigidStealer operation: TA2726 and TA2727. TA2726 functions as a traffic distribution service provider, directing users to compromised websites that host the malicious DMG file. TA2727 is responsible for delivering FrigidStealer to Mac users.

The campaign is not limited to macOS. It also deploys malware on Windows and Android devices, indicating a multi-platform attack strategy. This highlights the importance of protecting all of your devices, regardless of the operating system.

Proofpoint believes that TA2726 distributes traffic for other malware campaigns as well. Some operations previously attributed to TA569, also known as Mustard Tempest, Gold Prelude, and Purple Vallhund, have now been reclassified under TA2726 and TA2727. TA569 is linked to the cybercrime syndicate EvilCorp, a notorious group of hackers known for their sophisticated attacks.

Proofpoint also suspects that TA2727 purchases traffic through online forums to spread malware. This suggests that the threat actor may be offering its services to other cybercriminals, acting as a malware distributor. These distributors are involved in multiple web-based attack chains, including compromised website campaigns that use fake update-themed lures.

The Bigger Picture: Infostealers on the Rise

FrigidStealer is just one example of a growing trend: the rise of infostealer malware. These malicious programs are designed to steal credentials and other sensitive information from infected devices.

According to threat intelligence platform KELA, hackers using Lumma, along with StealC, Redline, and other infostealers, infected 4.3 million machines in 2024, compromising an estimated 330 million credentials. Security researchers also observed 3.9 billion credentials circulating in lists that appear to originate from infostealer logs.

Infostealer malware is expected to remain a persistent threat in 2025. With malware-as-a-service platforms on the rise and infostealers becoming more sophisticated, cybercriminals will likely continue relying on them as a primary tool for stealing credentials and infiltrating systems.

Protecting Yourself from Infostealers

Given the increasing threat of infostealer malware, it’s more important than ever to take proactive steps to protect your data. Here are four key ways to safeguard yourself from threats like FrigidStealer, Lumma, and other credential-stealing malware:

1. Beware of fake software updates: One of the most common infection methods is through deceptive browser update prompts. Never download updates from pop-ups or random websites. Instead, always update your software directly from official sources, such as the App Store or the application’s official website.

2. Enable two-factor authentication (2FA): Even if your credentials are stolen, 2FA adds an extra layer of security by requiring a secondary verification method, such as a one-time code sent to your phone. Use 2FA for all critical accounts, including email, banking, and cloud services.

3. Use a password manager: Many infostealers target saved passwords in web browsers. Instead of relying on your browser to store credentials, use a dedicated password manager. Password managers encrypt your passwords and store them securely, making it much more difficult for cybercriminals to steal them.

4. Be cautious with downloads and links. Use a strong antivirus: Infostealer malware often spreads through malicious downloads, phishing emails, and fake websites. Avoid downloading software or files from untrusted sources and always double-check links before clicking them. Attackers disguise malware as legitimate software, game cheats, or cracked applications, so it is best to stick to official websites and app stores for downloads. A strong antivirus program can help protect you from malicious links and downloads, alerting you to potential threats.

The Future of Cybersecurity: A Constant Battle

The digital landscape is constantly evolving, and so are the threats we face. FrigidStealer is just the latest reminder that no platform, not even macOS, is immune to the growing sophistication of cybercriminals. With infostealers like Lumma, StealC, and Redline already compromising millions of devices and billions of credentials, the rise of AI-driven attacks and social engineering scams signals a challenging road ahead.

It’s crucial to stay informed about the latest threats and take proactive steps to protect yourself. By being vigilant about software updates, using strong passwords and two-factor authentication, and being cautious about downloads and links, you can significantly reduce your risk of becoming a victim of cybercrime.