Emergence of New Malware-as-a-Service Infostealers Targeting Credentials and Crypto Wallets

Cybercriminals are actively marketing new information-stealing malware-as-a-service (MaaS) offerings on underground forums, with a focus on targeting credentials, browser data, and cryptocurrency wallets. The "MioLab MacOS" infostealer is being promoted as a resident macOS malware with a web-based control panel, customizable settings, and support for stealing data from over 200 crypto wallet extensions and more than 15 password managers, including Apple Keychain and LastPass. The malware is sold via a subscription model, with additional modules for hardware wallets like Ledger and Trezor, and is designed to appeal to cybercriminals seeking to compromise Apple devices and digital assets.

Separately, "SantaStealer" is a new infostealer being advertised on Telegram and hacker forums, operating as a rebranded version of BluelineStealer. It is promoted for its in-memory operation to evade detection, though researchers note its current samples are not as stealthy as claimed. SantaStealer features a user-friendly affiliate panel, multiple data-theft modules, and flexible configuration options, allowing attackers to tailor payloads for specific data theft objectives. Both malware families exemplify the growing sophistication and commercialization of MaaS operations, lowering the barrier for cybercriminals to launch targeted credential and asset theft campaigns.