Information stealers like DigitStealer fuel the cybercriminal economy by harvesting credentials for account takeovers, financial fraud, and sales on underground markets.
This macOS-focused malware has gained attention since its discovery in late 2025, with researchers uncovering its command-and-control (C2) infrastructure through operator errors.
DigitStealer’s predictable server patterns reveal a likely single-team operation targeting Apple Silicon devices.
DigitStealer Overview
Jamf Threat Labs first reported DigitStealer in mid-November 2025, noting its multi-stage design that steals from 18 cryptocurrency wallets, browsers, macOS Keychain, and more.
It spreads via fake apps like DynamicLake, using disk images that trick users into running malicious Terminal commands.
The malware checks for M2+ hardware, avoids VMs and certain locales, then deploys payloads entirely in memory for evasion.
Unlike Malware-as-a-Service models, DigitStealer lacks a shared web panel, suggesting control by one person or a small group.
It establishes persistence via a Launch Agent that polls C2 servers every 10 seconds for AppleScript or JavaScript tasks, sending MD5-hashed hardware UUIDs. Microsoft and Moonlock analyses confirm its focus on high-value data exfiltration before self-deletion.
Infrastructure Patterns Exposed
Researchers spotted DigitStealer’s C2 via X posts, starting with @suyog41’s January 2026 report on diamondpickaxeforge[.]com, which used a DynamicLake spoof.
Other domains like ebemvsextiho[.]com, bottleneckid[.]com, booksmagazinetx[.]com, goldenticketsshop[.]com, and fixyourallergywithus[.]com followed from users including @L0Psec and @malwrhunterteam.
All domains resolve to IPs on AS39287 (abstract Ltd, Sweden), run nginx on port 443 with Let’s Encrypt TLS, and share OpenSSH versions like SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.14.
They use Njalla nameservers and Tucows registrations, often in batches themed around gaming or crypto, such as ironswordzombiekiller[.]com.
C2 endpoints include /api/credentials for stolen data, /api/grabber for files, /api/poll for backdoor checks, and /api/log for exfiltration. Servers issue cryptographic challenges—hashing strings to specific patterns—for anti-analysis before granting session tokens.
This uniformity same ASN, server software, SSH banners, and registrars points to a streamlined workflow, not diverse MaaS users. Batches align with campaigns: mid-2025 and early 2026. Python scripts querying for nginx, .com CNs, and challenges confirm new C2s beyond public reports.
Defenders can hunt via SQL-like queries on Hunt.io: SELECT * FROM IP WHERE asn=39287 AND port=443 AND headers.server=’nginx’ AND subject.common_name LIKE ‘%.com’. Uniformity aids disruption, burning assets before attacks scale. Block these IOCs and monitor for similar traits.
According to Cyber And Ramen, digitStealer’s efficiency trades opsec for speed, exposing its network. Proactive fingerprinting counters such threats. Read more at Jamf Threat Labs and ThreatFox.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
