DigitStealer Gains Attention as macOS-Targeting Infostealer Exposes Key Infrastructure Weaknesses

DigitStealer is a sophisticated information-stealing malware targeting macOS systems, which has recently seen an increase in activity. It has captured the attention of the cybersecurity community due to its specific targeting of Apple M2 devices, distinguishing itself from generic threats.

The malware operates by harvesting sensitive user data, including information from 18 different cryptocurrency wallets, browser data, and macOS keychain entries. Unlike many modern infostealers that function as part of a Malware-as-a-Service (MaaS) ecosystem , DigitStealer lacks a web panel for affiliates, suggesting it is managed by a private operator or a small, exclusive team.

The primary infection vector involves the distribution of the malware disguised as legitimate applications such as the productivity tool "DynamicLake". Once a user installs the compromised software, the malware initiates a multi-stage infection process, establishing persistence by creating a Launch Agent, which ensures the malicious code runs automatically.

This backdoor capability allows the attacker to maintain long-term access, polling the C2 server every 10 seconds for new AppleScript or JavaScript payloads to execute various malicious functions on the device.

Analysts have identified that the malware’s infrastructure reveals a distinct lack of diversity, pointing towards a centralized operation. The malware's command servers are clustered within specific hosting networks, often using consistent domain registration patterns via providers like Tucows and nameservers from Njalla. This operational security failure has provided researchers with valuable indicators to track the threat, enabling security teams to better identify and block communication attempts between infected devices and the attacker’s infrastructure.

DigitStealer employs a complex mechanism designed to evade detection and analysis. It communicates with its C2 server through four specific API endpoints: /api/credentials , /api/grabber , /api/poll , and /api/log . These endpoints handle tasks such as credential exfiltration and file uploads.

To prevent security researchers from easily probing these servers, the malware implements a cryptographic challenge-response system. Before issuing any commands, the server sends a unique "challenge" string and a complexity level to the infected client. The malware must solve this computational puzzle by hashing the challenge string with a generated number to match a specific pattern. Only after successfully solving this challenge does the server grant a valid session token.

This anti-analysis feature ensures that automated scanners cannot easily interact with the command server . Additionally, the malware sends the hardware UUID of the system hashed with MD5 to the C2, creating a recognizable digital fingerprint for defenders to monitor and analyze.

Based on reporting by Cyber Security News.