Loading malware…
MacStealer is a macOS-focused information-stealing malware family that emerged amid a broader rise in macOS crimeware and is commonly referenced alongside other contemporary Mac infostealers such as Atomic Stealer, MetaStealer, Banshee Stealer, Poseidon, Cuckoo, Cthulhu Stealer, Pureland, and RealStealer. It is associated with campaigns targeting Mac users through social engineering and deceptive installation workflows rather than exploitation of privileged vulnerabilities. Reported lures have included Terminal-based trickery and other user-execution scenarios aimed at persuading victims to install the malware.
MacStealer is categorized as an infostealer. Its known role in the macOS threat ecosystem is the theft of sensitive user data, particularly credentials and other high-value information commonly sought by financially motivated operators. It has been cited as part of the wave of macOS-specific stealers marketed or deployed against individual users, including users likely to hold valuable browser, wallet, or account data.
Available high-confidence reporting in this context establishes MacStealer as a named macOS malware family but does not provide sufficiently corroborated technical detail here to attribute a fuller capability set, persistence model, or specific operator relationship beyond its use against macOS users in social-engineering-driven campaigns.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
8 distinct techniques documented for this family, organized by ATT&CK tactic.
Once achieved, a bogus password prompts users in an attempt to steal their real password. MacStealer then saves the password in the affected system’s temporary folder (TMP).
The malware then proceeds to collect and save the following... Cryptocurrency wallets... Various files (.TXT, .DOC, .DOCX, .PDF, .XLS, .XLSX, .PPT, .PPTX, .JPG, .PNG, .CVS, .BMP, .MP3, .ZIP, .RAR, .PY, .DB) System information in text form
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as an example of existing macOS malware in background context only.
MacStealer is a stealer malware targeting Mac users, typically distributed through social engineering tactics such as tricking users into running malicious commands.
Named as one of several new macOS infostealer families observed in 2023.
A macOS-specific infostealer mentioned as being offered for sale in crimeware forums.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.