Signed Installers and the macOS Infostealer Myth

Infostealers on Windows are old news. A fake installer runs, credentials get grabbed, the machine gets rebuilt. For years macOS sat outside that conversation. The assumption: signed installers and the App Store kept Macs clear of the problem. This week that assumption took another hit.

Myth

The myth goes like this. macOS does not get infostealers. Apple signs serious software, code signing catches tampering, and Mac malware is a hobby, not a business. If the binary is signed and the page looks official, running it is safe.

Reality

Signing proves one thing: the archive was not modified after the publisher’s key touched it. It says nothing about the publisher’s intent. Stealers need no kernel bug and no compromised Apple component. They need one user to click one wrong link and type a password into one convincing dialog.

New macOS stealer Sonoma hides in fake StreamYard, Zoom, Slack, and DocSend installers, then steals passwords, browser data, and crypto wallets.

HackerNoon

The Sonoma stealer, in the HackerNoon feed this week, runs that same playbook. It ships inside fake installers disguised as Zoom, Brave, Slack, StreamYard, and DocSend. Launch it and it takes passwords, browser data, and crypto wallets. Nothing here requires breaking macOS security. It requires the user, and the user is the one layer the default macOS stack assumes is competent.

Distribution matters, and it is not exotic. Search for an app, click the ad at the top, land on a clone of the vendor page, download a signed package. Code signing blocks none of it, because the attacker owns a signing cert or bought a stolen one. macOS also trains users to type their login password into every installer prompt, so one more dialog costs nothing.

Watch what this pattern implies. The victim does not need to be careless in a special way. The installer looks normal, the dialog looks normal, the certificate looks normal. Only the download source was wrong. Most detection happens after the fact, when a password manager starts dumping entries or an exchange shows a login nobody made.

How to protect

Treat every download as adversarial until verified. Three checks take under a minute, and each removes a failure mode.

Fix the entry point first. Bookmark the vendor’s real site. Never download from search results or ad slots. A parked domain ranking for “zoom download mac” is where this story starts.

Verify the artifact before running it. Compare the SHA-256 against the hash the vendor publishes, then read the signing certificate.

# Confirm the file matches what the vendor ships
shasum -a 256 Zoom.dmg          # compare to the hash on the vendor's own site

# Read the signing identity before you run anything
codesign -dv --strict Zoom.dmg 2>&1 | grep 'Authority='

# After install, watch what the app phones home to
sudo lsof -i -P -n | grep -i zoom

Watch behavior after install. A fresh app opening outbound connections to an unexpected host is a red flag, no matter how official the package looked. When something looks off, uninstall it and rotate the credentials it touched. Waiting costs more than acting.

Route the risk when you cannot verify. Run unknown installers in a throwaway VM or in a clean user account. macOS default protection is real. It is just aimed at the wrong threat. It blocks tampering, not deception.

None of this means the platform is broken. It means the trust model ends at the human clicking the link, and that human is the layer attackers keep paying for. Verify the artifact, or plan to hand it a password.