A newly identified information-stealing malware, dubbed Frigidstealer, has begun targeting macOS endpoints since its emergence in January 2025.
Designed to harvest sensitive user credentials and digital wallet details, Frigidstealer employs advanced social engineering tactics-most notably, masquerading as legitimate browser updates on compromised websites to deceive users into initiating the infection vector.
Sophisticated Threat Exploits Fake Updates
Unlike traditional malware strains that leverage direct exploits or technical vulnerabilities, Frigidstealer capitalizes on user trust in routine software updates.
Upon landing on a crafted fake update page, victims are prompted to download and manually open a malicious Disk Image (DMG) file.
Execution of this file invokes AppleScript to prompt for administrative credentials, enabling the attacker to circumvent macOS Gatekeeper protections and achieve initial access.
Once operational on a macOS system, Frigidstealer registers as an application under the alias ddaolimaki-daunito, typically installed at Volumes/Safari Updater/Safari Updater.app.
It then establishes persistence as a foreground application using the bundle identifier com.wails.ddaolimaki-daunito via the LaunchServices daemon (launchservicesd).
The malware leverages Apple Events for unauthorized inter-process communication (IPC), systematically targeting browser credentials, cryptocurrency wallets, sensitive files, and system information for exfiltration.
Of particular technical concern is Frigidstealer’s use of DNS-based data exfiltration through the mDNSResponder service.
This technique helps the malware covertly transmit stolen information to remote command-and-control (C2) infrastructure, often evading detection by traditional network security solutions.
Following successful data exfiltration, Frigidstealer terminates its process and removes related system jobs to minimize forensic artifacts and complicate post-incident investigation.
Advanced Detection and Response
In response to the growing threat posed by Frigidstealer, security teams have begun leveraging the Wazuh open-source Security Information and Event Management (SIEM) and Extended Detection and Response (XDR) platform.
Through custom configuration of the Wazuh agent on macOS endpoints, organizations can monitor Unified Logging System (ULS) events for suspicious activity patterns associated with Frigidstealer.
Decoders and detection rules are tuned to recognize telltale signs, including unexpected process registrations, suspicious DNS queries, Apple Events misuse, and stealthy process terminations.
Sample custom detection rules specifically target the registration and persistence mechanisms (ddaolimaki-daunito process activity and bundle identifiers).
Anomalous DNS queries by the malware, and any unauthorized Apple Events communications-each mapped to relevant MITRE ATT&CK techniques such as T1204 (User Execution), T1105 (Ingress Tool Transfer), and T1543 (Create or Modify System Process).
According to the Report, Alerts generated by Wazuh can be visualized on the security dashboard for immediate response and investigation.
Initial analysis suggests Frigidstealer may be connected to financially motivated actors, potentially linked to the notorious EvilCorp syndicate.
The scale and sophistication of the campaign underline the urgent need for enhanced macOS security postures across both enterprise and individual user environments.
Frigidstealer represents a significant escalation in macOS-targeted threats, emphasizing the necessity for continuous user education on social engineering risks and the deployment of advanced, customizable endpoint detection solutions.
As the threat landscape evolves, proactive monitoring and tailored response strategies-such as those facilitated by Wazuh-will be pivotal in defending against emerging credential theft malware.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates
