# DigitStealer, Phexia, Kitty Stealer hit macOS

Published: 2026-01-01 · Severity: routine
Canonical: https://vorant.io/reports/03335f48-fb53-5f34-a8ef-effe1c979716/digitstealer-phexia-kitty-stealer-hit-macos

> Objective-See's 2025 macOS malware review details new infostealers Kitty Stealer, DigitStealer, and Phexia harvesting browser data, crypto wallets, and Ledger Live credentials.

Objective-See's annual macOS malware roundup for 2025 highlights information stealers as the dominant threat category, continuing a trend from 2024. Three notable new families are detailed: Kitty Stealer (aka Purrglar), an unsigned arm64 Mach-O binary targeting Chrome cookies/logins and Exodus wallet files, discovered on VirusTotal while apparently still under development and offered for sale under a Malware-as-a-Service (MaaS) model; DigitStealer, a more sophisticated JXA-based multi-stage stealer/backdoor distributed via a fake DynamicLake.dmg disk image that instructs victims to bypass Gatekeeper via Terminal, performs anti-VM/geofencing checks (excluding CIS-region locales and older Apple Silicon lacking modern ARM security extensions), phishes local credentials, harvests browser/VPN/crypto-wallet data and the login keychain, trojanizes the Ledger Live Electron app, and establishes DNS-based command-and-control via a persistent Launch Agent that polls TXT records; and Phexia, another MaaS stealer notable for using a Dead Drop Resolver (DDR) technique and reverse-shell capability, distributed at scale through malvertising and social engineering.

All three families exemplify the commoditized MaaS ecosystem now dominant in macOS crime: malware authors sell tooling while independent 'traffer teams' handle distribution via fake software updates, malvertising, or ClickFix-style Terminal-paste scams. DigitStealer's operators used Cloudflare Pages for staged payload delivery and the domain goldenticketsshop.com for both exfiltration and DNS-driven C2, with a secondary domain (sweetseedsbeep.com) embedded as a backdoor endpoint injected into the Ledger Live app for ongoing wallet credential theft. None of the samples described exhibit confirmed large-scale victim compromise or novel privilege-escalation exploitation; the report is primarily a technical retrospective aggregating malware already documented by other vendors (Jamf, Moonlock, MalwareHunterTeam) rather than reporting a new active mass-exploitation event.

## Mentioned in this report

- Malware: DigitStealer, Kitty Stealer, Phexia

## Detection guidance (public sample)

### macOS LaunchAgent Plist Created for Persistence

ATT&CK: T1543.001

Detects creation of a new plist in a user's LaunchAgents directory, the persistence mechanism used by DigitStealer to maintain its DNS-based C2 backdoor across reboots. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: macOS LaunchAgent Plist Created for Persistence
description: Detects a new .plist file being written to ~/Library/LaunchAgents, a
  common persistence technique used by macOS stealers (e.g. DigitStealer) to relaunch
  a DNS C2 poller at login. Generalises on the target path pattern rather than any
  specific plist label or payload name.
tags:
- attack.persistence
- attack.t1543.001
logsource:
  category: file_event
  product: macos
detection:
  selection:
    TargetFilename|contains: /Library/LaunchAgents/
    TargetFilename|endswith: .plist
  filter_known_installers:
    Image|startswith:
    - /usr/sbin/installer
    - /System/Library/
  condition: selection and not filter_known_installers
falsepositives:
- Legitimate third-party software installers (updaters, backup agents) registering
  their own LaunchAgents
- IT-managed configuration profiles deploying agent plists
level: medium
id: 1d47887f-75f2-5efc-b10a-d8ed51fa93d2
status: experimental
author: Vorant
```

### Gatekeeper Quarantine Bypass via Terminal Command

ATT&CK: T1204

Detects xattr quarantine-flag removal or spctl Gatekeeper disable commands executed from Terminal/shell, matching ClickFix-style social-engineering instructions used to distribute DigitStealer and similar loaders. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Gatekeeper Quarantine Bypass via Terminal Command
description: Detects manual removal of the com.apple.quarantine extended attribute
  or disabling of Gatekeeper enforcement via spctl, the pattern victims are instructed
  to paste into Terminal in ClickFix-style macOS phishing/malvertising campaigns (e.g.
  DigitStealer's fake DynamicLake.dmg).
tags:
- attack.defense-evasion
- attack.t1204
- attack.t1027
logsource:
  category: process_creation
  product: macos
detection:
  selection_xattr:
    Image|endswith: /xattr
    CommandLine|contains:
    - com.apple.quarantine
    CommandLine|contains|all:
    - -d
  selection_spctl:
    Image|endswith: /spctl
    CommandLine|contains: --master-disable
  condition: selection_xattr or selection_spctl
falsepositives:
- Developers manually clearing quarantine flags on self-built or side-loaded unsigned
  applications
- Advanced users intentionally disabling Gatekeeper for testing
level: high
id: 2192b439-ad5f-5092-92ee-59d1c70c14c7
status: experimental
author: Vorant
```

### Suspicious DNS TXT Record Polling via Command-Line Tools

ATT&CK: T1071.004

Detects dig/nslookup invocations explicitly requesting TXT records, matching the DNS-based C2 polling behaviour used by DigitStealer's Launch Agent backdoor to retrieve commands via TXT lookups. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious DNS TXT Record Polling via Command-Line Tools
description: Detects command-line DNS utilities being invoked to explicitly query
  TXT records, a technique used by DNS-based C2 backdoors (e.g. DigitStealer) that
  poll TXT records for command/config data rather than performing routine name resolution.
  Legitimate interactive use of dig/nslookup for TXT lookups is uncommon outside of
  admin/debugging contexts.
tags:
- attack.command-and-control
- attack.t1071.004
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith:
    - /dig
    - /nslookup
    - /host
    CommandLine|contains:
    - TXT
    - -type=TXT
  filter_interactive_shell:
    ParentImage|endswith:
    - /bash
    - /zsh
    - /sh
  condition: selection and not filter_interactive_shell
falsepositives:
- Network administrators or DevOps scripts querying TXT records for SPF/DKIM validation
- Monitoring/automation tooling that polls DNS TXT records for configuration flags
level: medium
id: e6313e52-02ad-5f9f-aa0e-4c2ad9f07f8b
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

3 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Source reporting: https://objective-see.org/blog/blog_0x84.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/03335f48-fb53-5f34-a8ef-effe1c979716/digitstealer-phexia-kitty-stealer-hit-macos.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup