KELA REPORT

The Rise of macOS Infostealers: 2025 in Review

macOS is no longer a niche target: the infostealer families, delivery tricks and stolen data that made 2025 the year of Mac-focused credential theft.

Share:

KELA report cover: The Rise of macOS Infostealers: 2025 in Review

In KELA’s new report, you’ll learn:

  • What’s changed: How macOS moved from “safer by default” to a prime target—and why that perception gap persists.
  • How attacks land: Social engineering, fake installers, malvertising, and bypasses of Gatekeeper/XProtect.
  • About real-world case studies: Atomic Stealer (AMOS) and Quark Stealer—capabilities, pricing models, and monetization paths.
  • What to do now: Practical controls and multi-layered defense strategies to elevate macOS security.

Download the Report

Related Resources

KELA on-demand webinar banner: The TeamPCP arrests, from the inside, with Ben Kapon and Jimmy

The TeamPCP arrests, from the inside

KELA report cover: TeamPCP Threat Actor Profile

TeamPCP Threat Actor Profile

KELA press release banner: "Breaking: KELA research leads to alleged TeamPCP members arrested," with police escorting a person in custody

KELA research leads to alleged TeamPCP Members Arrested