Loading story…
The source code for Banshee Stealer, a macOS Malware-as-a-Service infostealer, was leaked online, and its operators reportedly shut down after the disclosure. Archived by VXunderground and later shared on GitHub, the leak exposed tooling that had been marketed on underground forums and built to target both x86_64 and ARM64 macOS systems.
Prior reverse engineering showed Banshee stealing browser data, Safari cookies, keychain material, cryptocurrency wallet contents, browser-extension data, and files from user directories. The malware used basic anti-debugging, anti-virtualization, and Russian-language checks, phished for the victim’s password through an AppleScript prompt validated with dscl, and exfiltrated compressed data after XOR encryption and Base64 encoding via HTTP POST to 45.142.122[.]92/send/. Researchers noted that despite broad collection capabilities, the malware lacked strong obfuscation and retained C++ symbols that made analysis easier.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
The source code for BANSHEE Stealer leaked online in November 2024, exposing the malware's implementation and project structure.
BANSHEE Stealer emerged in August 2024 as a macOS infostealer and was reportedly advertised by Russian threat actors on an underground forum as a subscription malware offering.
Following the source code leak, the operators of BANSHEE Stealer reportedly ceased operations.
After the leak, VXunderground archived the BANSHEE Stealer source code and published it on GitHub, making the code broadly accessible.
Elastic Security Labs analyzed BANSHEE Stealer and documented its anti-analysis checks, password phishing, browser and wallet theft, keychain targeting, and HTTP POST exfiltration workflow.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a new macOS infostealer, **AmnesiaStealer**, being spread through **ClickFix-style** social engineering that tricks users into copying and pasting a malicious command into Terminal, including via fake GitHub download pages. The multi-stage infection chain uses a Bash loader to profile the host and retrieve a processor-specific Mach-O payload written in Go, then steals browser passwords, Apple Keychain data, cached credentials, Telegram sessions, Apple Notes, documents, and other sensitive information from infected systems. Investigators said the malware also includes cryptocurrency-theft functionality that can transfer wallet funds to attacker-controlled addresses, and a later-stage component, `stream_module`, can be fetched on demand to clone browser profiles and attach to the Chrome DevTools Protocol for covert access to already authenticated browser sessions. Huntress linked parts of the loader, payload-hosting, and command-and-control infrastructure to the **Aeza Group**, a sanctioned Russian bulletproof hosting provider tied to cybercrime, while Jamf noted some privacy-bypass methods are outdated on newer macOS releases even though the malware’s credential theft and session-hijacking features remain effective.
Aug 24, 2026
An exposed staging environment uncovered by CloudSEK revealed a financially motivated, Chinese-speaking threat operator using multiple AI coding agents as an autonomous offensive platform to support cryptocurrency theft and mass compromise operations. Files in the open directory documented two campaigns running from 10 July to 28 July 2026: opportunistic WordPress exploitation for cryptojacking and targeted intrusions against cryptocurrency and DeFi organizations. The leaked workspace contained more than **12,000** WordPress backdoor records, **66** harvested administrator credential sets, a reconnaissance corpus covering **3.4 million** hosts, live API keys and admin tokens, and stolen cryptocurrency wallet private keys and seed phrases. CloudSEK said the operator managed agents through Telegram, disabled approval safeguards, and reused a fake Chinese-language "authorized pentest" jailbreak prompt to drive offensive actions, while also developing a blockchain-based `DeadDropC2` framework that appeared to remain in local testing. A separate exposed repository on `45.61.136.49` showed the same broader pattern of openly accessible attacker infrastructure, this time serving macOS malware through downloader scripts named **Chrome**, **claude**, and **codex**. Those scripts retrieved a Mach-O universal binary called `codexclod`, cleared macOS quarantine attributes, made the file executable, and launched it, suggesting a delivery chain designed to lure Apple users with trusted software and AI-brand filenames. Investigators found no victim databases or proprietary documents in that repository, but the staging setup reinforced how misconfigured attacker infrastructure can expose active payload delivery, tooling, and operational tradecraft tied to credential compromise and crypto-focused theft.
Aug 20, 2026
Researchers reported a macOS malware campaign distributing an updated **SHub Stealer** variant, dubbed **Reaper**, through fake download pages impersonating trusted software such as WeChat and Miro. The infection chain uses an automated ClickFix-style technique that avoids Terminal paste protections in macOS by opening the built-in **Script Editor** through an `applescript://` link with malicious code already loaded, requiring only a single user action to run. The malware then presents a fake Apple security update prompt to capture the victim’s password while using typo-squatted domains and brand impersonation to make the attack appear legitimate. Once executed, Reaper steals documents, browser credentials from Chrome, Firefox, Brave, Edge, and Opera, along with Keychain and iCloud-related data, Telegram sessions, and cryptocurrency wallet information. It exfiltrates files in chunked ZIP archives to attacker-controlled infrastructure, including via `curl`, modifies legitimate desktop crypto wallet applications to redirect future funds, and establishes persistence through a fake Google Software Update service. Researchers also said the malware checks for a Russian keyboard layout and exits if detected, and noted that this is the third observed automated ClickFix-style macOS campaign in less than two months, indicating the technique is gaining traction among macOS threat actors.
Jun 29, 2026