Macstealer

Malware updated 5 months ago (2024-05-04T19:39:52.862Z)
Download STIX
Preview STIX
MacStealer is a malicious software (malware) first observed in March 2023, specifically designed to exploit macOS devices ranging from Catalina (macOS 10) to Ventura (macOS 13), including those using Intel M1 and M2 CPUs. The malware uses the native macOS osascript utility to mimic a legitimate system prompt, thereby tricking users into providing their passwords. It can extract sensitive data such as passwords, cookies, and credit card information from Firefox, Google Chrome, and Brave browsers, including the ability to extract the KeyChain database. Moreover, it can steal documents, browser cookies, and login credentials, positioning itself as a significant threat to user privacy and security. In June 2023, MacStealer emerged with similar capabilities as other contemporary malware targeting macOS devices. Unlike its counterparts, such as Atomic Stealer, MacStealer is not limited to Desktop and Documents folders but can infiltrate various file directories associated with targeted browsers. Furthermore, it can extract files from a wide array of file types including TXT, DOC, DOCX, PDF, XLS, XLSX, PPT, PPTX, JPG, PNG, CSV, BMP, MP3, ZIP, RAR, PY, and DB, thus demonstrating a broader range of capabilities. Despite the similarities with other malware like Atomic Stealer, MacStealer differentiates itself by the browsers it supports and its method of collecting desktop files. It only collects passwords, cookies, and credit card information from Firefox, Chrome, and Brave browsers by directly querying file directories associated with these browsers. By doing so, MacStealer presents a unique threat profile, necessitating specific countermeasures for protection against its attacks.
Description last updated: 2024-05-04T17:29:49.708Z
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Aliases We are not currently tracking any aliases
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Macos
Malware
Telegram
Uptycs
Chrome
Credentials
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Source Document References
Information about the Macstealer Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
PreviewSource LinkCreatedAtTitle
CERT-EU
7 months ago
BankInfoSecurity
7 months ago
CERT-EU
10 months ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
DARKReading
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
Securelist
a year ago
InfoSecurity-magazine
2 years ago
Securityaffairs
2 years ago
CERT-EU
2 years ago
DARKReading
2 years ago