Proofpoint has identified a new MacOS malware delivered via web inject campaigns that researchers dubbed “FrigidStealer.” The data protection company says the web inject campaign landscape is increasing,

TA2726, per the enterprise security firm, acts as a TDS for TA2727 and another threat actor called TA569, which is responsible for the distribution of a JavaScript-based loader malware referred to as SocGholish (aka FakeUpdates) that often masquerades as a browser update on legitimate-but-compromised sites.

Fake browser updates are an easy way to trick unsuspecting users into downloading and installing malware which is why hackers keep using them in their attacks.

Threat actors are seen distributing the new macOS stealer in a web inject campaign, along with stealers for other operating systems.