A New Wave of macOS Malware Emerges, Masked by Developer Tools
A novel strain of data-harvesting malware has been identified, uniquely leveraging legitimate software packaging tools to slip past modern security defenses.
First spotted in April 2025, this malware variant showcases a refined approach by cybercriminals targeting Apple environments. For months, it bypassed mainstream malware scanners without raising alarms.
Central to the campaign is PyInstaller—a widely used open-source utility for compiling Python scripts into standalone executables. While indispensable for cross-platform developers, PyInstaller is now being weaponized to conceal malicious payloads within benign-looking Mach-O binaries. This approach is particularly timely: with Apple removing system-wide Python support in macOS 12.3, attackers and developers alike are turning to PyInstaller to ensure compatibility across macOS devices.
Jamf Threat Labs uncovered several unflagged malware samples on VirusTotal, dating back to January 2025, marking what appears to be the first known exploitation of PyInstaller to deploy infostealers on macOS.
By embedding Python-based malicious code inside self-contained executables, attackers are able to sidestep the need for a local Python runtime on victim machines. Once executed, the malware behaves like a typical infostealer—but with sharper tools. It prompts users with an AppleScript-based credential request, alters local system configurations, and quietly establishes contact with remote command servers.
What sets this threat apart is its dual capability: not only does it pull credentials from the macOS Keychain, it also hunts for digital wallets—aiming directly at financial assets.
A closer look at the malware’s binary revealed a telltale signature. The arm64 segment of the Mach-O file is disproportionately large compared to the Intel slice—clocking in at 8MB versus just 70KB. Researchers traced the embedded PyInstaller archive to the tail end of the arm64 portion, a design choice that enables smooth execution on both Intel and Apple Silicon systems while keeping its malicious intent obscured.
Dissecting the Mach-O Payload with Pyinstxtractor (Credit: Jamf)
Upon deep inspection, the malicious binary exposes a cleverly masked architecture. Analysts used Pyinstxtractor to peel back the layers of the Mach-O file, uncovering a web of advanced evasion tactics. These obfuscation methods aren’t just surface-level tricks—they’re strategically engineered to blur the malware’s intent, complicating detection and analysis at every stage.
Unmasking the Payload: Bytecode Deconstruction with PyLingual (Credit: Jamf)
Once the malicious Mach-O binary was unpacked using Pyinstxtractor and its Python bytecode peeled back with PyLingual, analysts were met with a deeply layered defense mechanism that masked the malware’s true behavior.
At the heart of the obfuscation was a cleverly crafted line of code:
python
lambda : import(‘zlib’).decompress(bytes((x ^ 188 for x in import(‘base64’).b85decode(_[::-1]))))
This snippet exemplifies a multi-stage concealment strategy. The payload was buried under layers of string reversal, base85 encoding, XOR-based encryption (key: 188), and final compression via zlib. This cocktail of obfuscation techniques effectively transformed the script into digital camouflage.
Once decrypted, the code revealed clear evidence of the malware’s operational design: instructions to build a PyInstaller binary, confirming a deliberate effort to package and deliver Python-based payloads in stealth mode.
Interestingly, runtime analysis using tools like Mac Monitor revealed none of the usual Python signatures one might expect. Instead, it was subtle indicators—environment variables such as _PYI_APPLICATION_HOME_DIR, _PYI_ARCHIVE_FILE, and _PYI_PARENT_PROCESS_LEVEL—that exposed the presence of the PyInstaller framework operating covertly in the background.
During execution, the malware temporarily extracts its bundled libraries into an ephemeral directory, which vanishes as soon as the process ends—leaving behind virtually no forensic trace.
By slightly altering the script to print the payload instead of executing it, researchers exposed its full functionality: deceptive password prompts mimicking system dialogs, remote AppleScript execution, systematic siphoning of macOS Keychain contents, and targeting of local cryptocurrency wallets. All of it engineered for silent, targeted exfiltration of sensitive data.
With such tactics becoming more refined, experts urge organizations to be cautious of unsigned Mach-O files—especially those initiating unexpected credential prompts or exhibiting odd runtime behavior. Defenders should enhance visibility into PyInstaller-related activity and monitor for the telltale environment markers that indicate potential compromise.
