MacOS Digitstealer Anti Analysis Checks

Tim Peck@timpeck

•updated Nov 13, 2025•1•0•89

Detects the execution of `sysctl` commands querying for specific Apple Silicon M2+ hardware features. This behavior is used by the DigitStealer malware for anti-analysis purposes to evade detection and target specific hardware.