NovaStealer
NovaStealer is a macOS infostealer targeting the macOS ecosystem. Reported capabilities include exfiltrating wallet-related files, collecting telemetry data, and replacing legitimate Ledger and Trezor applications with tampered copies. Analysis cited in the source indicates it uses a dropper to execute mdriversinstall.sh, installs an orchestrator under ~/.mdrivers, registers a LaunchAgent labeled application.com.artificialintelligence for persistence, and retrieves base64-encoded scripts from command-and-control infrastructure to execute in detached screen sessions. The malware has been linked in reporting to payload delivery via base64-encoded shell commands that download NovaStealer- or Atomic Stealer-linked payloads. A published analysis by security researcher Bruce Ketta is specifically referenced. High-confidence indicators and artifacts mentioned in the content include mdriversinstall.sh, the ~/.mdrivers path, and the LaunchAgent label application.com.artificialintelligence.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The campaign coincides with the disclosure of a high-severity OpenClaw vulnerability (CVE-2026-25253) that enables one-click remote code execution through token exfiltration and WebSocket hijacking. Although patched in late January 2026, the flaw points to the platform’s growing attack surface.
Techniques & procedures
4 distinct techniques documented for this family, organized by ATT&CK tactic.
IOCs tracked for this family
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Information-stealing malware delivered via malicious OpenClaw “skills,” used to harvest sensitive data (e.g., API keys, credentials, cloud secrets) from infected systems.
macOS stealer that targets cryptocurrency users by exfiltrating wallet-related files and telemetry, and by replacing legitimate Ledger/Trezor apps with trojanized versions. Uses a dropper to install a script orchestrator (~/.mdrivers) and persistence via a LaunchAgent (application.com.artificialintelligence), then pulls additional base64-encoded scripts from C2 and runs them in detached screen sessions.
NovaStealer is an infostealer malware targeting macOS systems, designed to steal sensitive information from infected devices.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.