DigitStealer, Phexia, Kitty Stealer hit macOS
Objective-See's 2025 macOS malware review details new infostealers Kitty Stealer, DigitStealer, and Phexia harvesting browser data, crypto wallets, and Ledger Live credentials.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Objective-See's annual macOS malware roundup for 2025 highlights information stealers as the dominant threat category, continuing a trend from 2024. Three notable new families are detailed: Kitty Stealer (aka Purrglar), an unsigned arm64 Mach-O binary targeting Chrome cookies/logins and Exodus wallet files, discovered on VirusTotal while apparently still under development and offered for sale under a Malware-as-a-Service (MaaS) model; DigitStealer, a more sophisticated JXA-based multi-stage stealer/backdoor distributed via a fake DynamicLake.dmg disk image that instructs victims to bypass Gatekeeper via Terminal, performs anti-VM/geofencing checks (excluding CIS-region locales and older Apple Silicon lacking modern ARM security extensions), phishes local credentials, harvests browser/VPN/crypto-wallet data and the login keychain, trojanizes the Ledger Live Electron app, and establishes DNS-based command-and-control via a persistent Launch Agent that polls TXT records; and Phexia, another MaaS stealer notable for using a Dead Drop Resolver (DDR) technique and reverse-shell capability, distributed at scale through malvertising and social engineering.
All three families exemplify the commoditized MaaS ecosystem now dominant in macOS crime: malware authors sell tooling while independent 'traffer teams' handle distribution via fake software updates, malvertising, or ClickFix-style Terminal-paste scams. DigitStealer's operators used Cloudflare Pages for staged payload delivery and the domain goldenticketsshop.com for both exfiltration and DNS-driven C2, with a secondary domain (sweetseedsbeep.com) embedded as a backdoor endpoint injected into the Ledger Live app for ongoing wallet credential theft. None of the samples described exhibit confirmed large-scale victim compromise or novel privilege-escalation exploitation; the report is primarily a technical retrospective aggregating malware already documented by other vendors (Jamf, Moonlock, MalwareHunterTeam) rather than reporting a new active mass-exploitation event.
Mentioned in this report
Detection guidance
macOS LaunchAgent Plist Created for Persistence
A behavioural hunt for the technique in general.
Detects creation of a new plist in a user's LaunchAgents directory, the persistence mechanism used by DigitStealer to maintain its DNS-based C2 backdoor across reboots. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: macOS LaunchAgent Plist Created for Persistence
description: Detects a new .plist file being written to ~/Library/LaunchAgents, a
common persistence technique used by macOS stealers (e.g. DigitStealer) to relaunch
a DNS C2 poller at login. Generalises on the target path pattern rather than any
specific plist label or payload name.
tags:
- attack.persistence
- attack.t1543.001
logsource:
category: file_event
product: macos
detection:
selection:
TargetFilename|contains: /Library/LaunchAgents/
TargetFilename|endswith: .plist
filter_known_installers:
Image|startswith:
- /usr/sbin/installer
- /System/Library/
condition: selection and not filter_known_installers
falsepositives:
- Legitimate third-party software installers (updaters, backup agents) registering
their own LaunchAgents
- IT-managed configuration profiles deploying agent plists
level: medium
id: 1d47887f-75f2-5efc-b10a-d8ed51fa93d2
status: experimental
author: Vorant
Gatekeeper Quarantine Bypass via Terminal Command
A behavioural hunt for the technique in general.
Detects xattr quarantine-flag removal or spctl Gatekeeper disable commands executed from Terminal/shell, matching ClickFix-style social-engineering instructions used to distribute DigitStealer and similar loaders. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Gatekeeper Quarantine Bypass via Terminal Command
description: Detects manual removal of the com.apple.quarantine extended attribute
or disabling of Gatekeeper enforcement via spctl, the pattern victims are instructed
to paste into Terminal in ClickFix-style macOS phishing/malvertising campaigns (e.g.
DigitStealer's fake DynamicLake.dmg).
tags:
- attack.stealth
- attack.t1204
- attack.t1027
logsource:
category: process_creation
product: macos
detection:
selection_xattr:
Image|endswith: /xattr
CommandLine|contains:
- com.apple.quarantine
CommandLine|contains|all:
- -d
selection_spctl:
Image|endswith: /spctl
CommandLine|contains: --master-disable
condition: selection_xattr or selection_spctl
falsepositives:
- Developers manually clearing quarantine flags on self-built or side-loaded unsigned
applications
- Advanced users intentionally disabling Gatekeeper for testing
level: high
id: 2192b439-ad5f-5092-92ee-59d1c70c14c7
status: experimental
author: Vorant
Suspicious DNS TXT Record Polling via Command-Line Tools
A behavioural hunt for the technique in general.
Detects dig/nslookup invocations explicitly requesting TXT records, matching the DNS-based C2 polling behaviour used by DigitStealer's Launch Agent backdoor to retrieve commands via TXT lookups. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious DNS TXT Record Polling via Command-Line Tools
description: Detects command-line DNS utilities being invoked to explicitly query
TXT records, a technique used by DNS-based C2 backdoors (e.g. DigitStealer) that
poll TXT records for command/config data rather than performing routine name resolution.
Legitimate interactive use of dig/nslookup for TXT lookups is uncommon outside of
admin/debugging contexts.
tags:
- attack.command-and-control
- attack.t1071.004
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith:
- /dig
- /nslookup
- /host
CommandLine|contains:
- TXT
- -type=TXT
filter_interactive_shell:
ParentImage|endswith:
- /bash
- /zsh
- /sh
condition: selection and not filter_interactive_shell
falsepositives:
- Network administrators or DevOps scripts querying TXT records for SPF/DKIM validation
- Monitoring/automation tooling that polls DNS TXT records for configuration flags
level: medium
id: e6313e52-02ad-5f9f-aa0e-4c2ad9f07f8b
status: experimental
author: Vorant
3 more detections for this report are in the app — indicator rules, each with Sigma, Splunk SPL, and Elastic, some with Microsoft Defender XDR KQL, YARA, or Suricata as well. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x84.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs