If you run a Mac and assume malware is a Windows problem, 2026 is the year to update that belief. Infostealers are now the fastest-growing category of macOS malware, and they are being sold as subscription services on Telegram for as little as $200 a month. The people deploying them are not elite hackers. They are affiliates running copy-paste campaigns, and they only need you to slip up once.
A macOS infostealer does exactly what the name implies: it steals information. Within seconds of executing, a modern stealer like Atomic (AMOS), Poseidon, or Cthulhu can sweep your Keychain passwords, browser cookies, saved logins, crypto wallet files, and even the contents of your ~/Documents folder, then upload it all to a command-and-control server. The whole operation is often over before you finish reading the fake "verification" dialog that tricked you into typing your password.
This guide is written for people who actually use their Macs for real work. You will learn how these stealers get in, how to detect one that may already be running, a full step-by-step removal walkthrough, and how to lock your machine down so the next campaign bounces off. No fear-mongering, just the practical mechanics.
Key Takeaways
- macOS infostealers prioritize speed: they grab Keychain data, browser cookies, and crypto wallets in seconds, then delete themselves.
- The most common infection path in 2026 is a fake app installer or a copy-paste terminal command from a "fix your error" webpage.
- Detection relies on spotting suspicious LaunchAgents, unexpected outbound connections, and unsigned binaries, not just antivirus scans.
- After removal you must rotate every saved password and revoke active sessions, because stolen cookies bypass your passwords entirely.
- Prevention comes down to Gatekeeper discipline, never pasting unknown terminal commands, and using a password manager with hardware-backed keys.
What Is macOS Infostealer Malware and How Does It Work?
An infostealer is a lightweight program designed to harvest credentials and sensitive files, exfiltrate them quickly, and leave minimal traces. Unlike ransomware, it does not want your attention. The longer it stays quiet, the more accounts the operator can drain.
On macOS, the typical stealer follows a predictable sequence:
- Execution. You run a malicious installer, a cracked app, or paste a terminal command that downloads a payload.
- Privilege prompt. A fake system dialog asks for your macOS password "to install helper tools" or "verify your identity."
- Harvest. The malware uses your password to dump the login Keychain, copies browser profile databases (cookies, autofill, saved passwords), and scans for wallet files like
wallet.dator Electrum data. - Exfiltration. Everything gets zipped and POSTed to a remote server over HTTPS.
- Cleanup. Many stealers self-delete or install a LaunchAgent for persistence if they intend to steal again later.
Why Macs Became a Target
Two reasons. First, Apple's market share among developers, founders, and crypto users grew fast, and those people hold high-value credentials. Second, the tooling matured. AMOS pioneered the "malware as a service" model on macOS, and competitors copied it. When the barrier to entry drops, volume goes up.
How macOS Infostealers Infect Your Mac in 2026
Understanding the delivery method is half the battle, because almost every infection requires you to take an action. Gatekeeper and notarization stop the drive-by attacks that plague other platforms, so attackers lean on social engineering instead.
The Fake Installer
You search for an app, land on a lookalike site, and download a .dmg. It looks legitimate. But the installer instructs you to right-click and choose Open rather than double-click, specifically to bypass Gatekeeper's block on unsigned software. That instruction is the tell. A legitimate signed app never needs it.
The Copy-Paste Terminal Trap
This is the fastest-growing vector. A page claims your browser has an error, or that you need to "verify you are human," and provides a command to paste into Terminal. It usually looks like a harmless curl or osascript line. Running it downloads and executes the stealer with your user privileges. If you ever see instructions to paste something into Terminal to fix a website, close the tab.
Cracked Software and "Free" Pro Apps
Pirated versions of paid apps remain a reliable delivery channel. This is a good moment to mention that sourcing tools from a vetted marketplace matters. When you buy from a curated store like the LionScripts product catalog instead of chasing cracks, you sidestep an entire category of risk. Our take on why this is worth it is covered indirectly in our piece on auditing open source licenses in your software stack.
Warning Signs Your Mac May Be Infected
Infostealers are quiet, but they are not invisible. Watch for these signals:
- A macOS password prompt appeared right after you opened a downloaded app, and the wording felt slightly off.
- Your browser sessions get logged out unexpectedly, or you receive login alerts from unfamiliar locations.
- Crypto wallet balances change without your action.
- The fan spins up and the CPU spikes for a few seconds shortly after opening a new app.
- Friends report messages or emails you never sent.
- New login items or background processes you do not recognize.
A Worked Detection Example
Say you downloaded what you thought was a video converter three days ago. Since then, you have been logged out of Gmail twice and your exchange account flagged a login from another country. Here is how you would confirm suspicion in under ten minutes.
- Open Terminal and list persistence agents:
ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons. You spot a file namedcom.apple.helper.plistdated the same day as your download. Apple does not name things that way, and the timestamp lines up. Red flag. - Inspect it:
cat ~/Library/LaunchAgents/com.apple.helper.plist. It points to a binary in/tmpor a hidden folder in your home directory. Legitimate agents point to app bundles or system paths. - Check active outbound connections:
lsof -i -P | grep ESTABLISHED. You see a process you do not recognize talking to an IP on a strange port. - Cross-reference the binary's signature:
codesign -dv --verbose=4 /path/to/binary. It returnscode object is not signed at all. Confirmed. Time to remove it.
How to Remove macOS Infostealer Malware Step by Step
Once you suspect an active stealer, speed matters. The goal is to cut its network access, kill persistence, remove the payload, and then rotate everything it may have touched. Follow these steps in order.
- Disconnect from the network. Turn off Wi-Fi and unplug Ethernet. This stops ongoing exfiltration immediately. Do not skip this to "finish one thing."
- Identify running malicious processes. Open Activity Monitor, sort by CPU and Network, and note anything unfamiliar. Cross-check with the
lsofoutput from your detection step. - Kill the process. In Terminal, run
kill -9 <PID>using the process ID you found. - Remove persistence files. Delete the suspicious plist files you identified in
~/Library/LaunchAgents,/Library/LaunchAgents, and/Library/LaunchDaemons. Also check~/Library/Application Supportfor oddly named folders created on the infection date. - Delete the payload binary. Remove the actual executable the plist pointed to, along with anything the stealer dropped in
/tmpor hidden dot-folders. - Remove the source app. Drag the malicious app to the Trash and empty it. Then check Login Items in System Settings and remove anything you did not add.
- Run a reputable scanner. Tools like Malwarebytes for Mac or KnockKnock (which lists persistently installed items) confirm you got everything. Run at least one on-demand scan.
- Reconnect and rotate credentials. This is the step people skip and regret. Move on to the recovery section below.
When to Wipe Instead of Clean
If the stealer had root access, or if you find multiple persistence mechanisms, a clean install is the honest answer. Back up your documents (not the applications), erase the drive, reinstall macOS, and restore selectively. It is a few hours of work versus never being fully sure you are clean.
What to Do After Removal: The Recovery Checklist
Removing the malware stops future theft. It does nothing about the data already exfiltrated. Stolen browser cookies let attackers log in without your password, so changing passwords alone is not enough.
- Revoke active sessions everywhere. In Google, Apple, Microsoft, and every major service, sign out all devices. This invalidates the stolen cookies.
- Rotate high-value passwords first: email, password manager, banking, crypto exchanges, then everything else.
- Move crypto immediately if wallet files were on the machine. Assume the seed phrase is compromised.
- Enable phishing-resistant 2FA using passkeys or a hardware key. If you are switching managers during this process, our guide on migrating passkeys between password managers safely walks through the pitfalls.
- Reset your macOS login password and consider rebuilding your Keychain if it was dumped.
A Realistic Rotation Plan
Say your manager holds 84 logins. Rotating all 84 in one sitting is unrealistic and leads to skipped entries. Instead, triage: rotate the top 10 financial and identity accounts within the first hour, the next 30 "sensitive but recoverable" accounts within 24 hours, and the long tail over the week. Track progress in a spreadsheet so nothing slips.
Detection and Removal Tools Compared
No single tool covers everything. On-demand scanners catch known signatures, behavioral tools catch persistence, and network monitors catch exfiltration. Here is how the common options stack up.
