For years, malware built specifically to run on macOS and steal credentials was rare enough to be notable on its own. That changed from 2023 onward, as a category widely referred to as "infostealer" malware — malware, in Apple’s own words, whose entire purpose is stealing data.
These programs are not sophisticated in a technical sense — they do not need a zero-day flaw. They typically arrive as a cracked copy of paid software, a fake update prompt, or a download promoted through malicious search ads, and once opened, they simply ask the user to type their Mac login password into a normal-looking system dialog — which is often all it takes.
What they actually take
Once granted that password, this class of malware copies saved browser passwords, autofill data, cryptocurrency wallet files and login cookies, packages them, and sends them to a server controlled by the attacker in a single upload — usually within seconds of being run.
Why Gatekeeper alone does not stop this
Apple’s built-in defenses — Gatekeeper, notarization and XProtect — are designed to block known malware and unsigned code, and Apple has said clearly that XProtect’s signature-based approach can still miss new or modified variants. A freshly repackaged infostealer, distributed through a convincing fake download page, can slip past that first layer simply by not matching a known signature yet.
- This malware’s goal is to steal information, not to damage your Mac — so there are often no crashes or slowdowns to notice.
- It nearly always arrives disguised as something you went looking for: a "free" version of paid software, a codec, a "required" update.
- The one thing it cannot avoid is sending your data somewhere — an outbound connection, right after installation, to a server the app has no legitimate reason to talk to.
How FireAI and HisnLabs fit in
Password-stealing malware like this has one job: quietly send what it copied somewhere else. That single outbound connection, right after a suspicious download, is exactly the moment a network-level firewall is built to catch.
FireAI is HisnLabs’ own product: an on-device AI firewall for Mac. It shows every connection your apps make, in plain language, and lets you decide what leaves your Mac — its AI runs locally, so your traffic is never sent to us or anyone else. HisnLabs’ security research team is the group that keeps that decision-making accurate: cataloguing which domains are ordinary telemetry versus a real product, tracking the country and network behind a connection, and training the on-device model (its Autopilot feature) on real traffic patterns, all without any of it leaving your Mac.
You can read the technical decisions behind it, or try FireAI for 17 days, at FireAI, by HisnLabs.