Threat actors are seen distributing the new macOS stealer in a web inject campaign, along with stealers for other operating systems.

A recently identified macOS infostealer named FrigidStealer has been distributed through a compromised website, as a fake browser update.

TA2726, per the enterprise security firm, acts as a TDS for TA2727 and another threat actor called TA569, which is responsible for the distribution of a JavaScript-based loader malware referred to as SocGholish (aka FakeUpdates) that often masquerades as a browser update on legitimate-but-compromised sites.