Mac Security · Mac Malware: Myth vs Reality · Lesson 2 of 5

Info-Stealers and Fake Apps

How Mac info-stealers grab passwords, cookies and crypto, and how they get in.

What an info-stealer takes

An info-stealer is malware built to grab your private data and send it to criminals, fast. It doesn't show ads or slow your Mac down. Often you never notice it.

Security companies have tracked many Mac info-stealers in recent years. One of the best known is Atomic Stealer, also called AMOS. Researchers at the security firm Cyble reported it in 2023. Its makers rented it to other criminals on the messaging app Telegram for about $1,000 a month.

Reports from Cyble, Malwarebytes and others say stealers like this go after:

• Saved passwords, in your browser and in Keychain, the Mac's built-in password store.
• Cookies, small files websites save to keep you signed in. With your cookies, a thief may get into an account without your password or your two-step code.
• Crypto wallets, apps and browser add-ons that hold digital money like Bitcoin.
• Card details saved in the browser, plus files from places like your Desktop and Documents.

How does it get in? Mostly by tricking you. Malwarebytes linked Atomic Stealer to fake browser updates on hacked websites. Other stealers spread through ads in search results, cracked apps and fake copies of popular tools.

To open your Keychain, a stealer usually needs your Mac password. So it simply asks for it, with a fake box. The next lesson shows how that works.

The cookie part is what makes info-stealers so harmful. Changing your passwords is important, but it isn't always enough. You also want to sign out of every other session on your important accounts, so stolen cookies stop working. A later module walks through it.

Fake password prompts and cracked apps

You open a new app. A box appears asking for your Mac password. It might say "System Settings" or "macOS wants to make changes." Is it real?

Real password requests happen, so this is tricky. macOS asks for your password when you install software, change a locked setting or approve something you started. The key word is started. You did something that needs permission, so the request makes sense.

A fake box often appears with no clear reason, right after you opened something new from the internet. Security researchers report that Atomic Stealer shows a fake prompt like this as soon as it runs. Some stealers show it again and again until you give in.

If a password box appears out of nowhere, click Cancel. If it keeps coming back, that's a strong warning sign. Quit the app, move it to the Trash, and don't open it again.

A cracked app is a paid app that someone changed so it works without paying. They're shared on piracy sites and forums. Researchers keep finding malware hidden inside them. Whoever removed the payment check could add anything else too.

Cracked apps trick you in another way. They aren't notarized, so macOS warns you before they open. Many come with instructions telling you to get around that warning, or to paste a command into Terminal. Those instructions are the trap.

Safer habits:

• Get apps from the App Store or the maker's own website.
• Look for a free, legal app instead of a cracked one.
• Be wary of apps promising free money, crypto or paid features for nothing.
• Only type your Mac password when you know exactly why it's needed.