MacStealer: New MacOS-based Stealer Malware Identified

MacStealer is a macOS stealer distributed via DMG that is controlled over Telegram, marking a new platform for stealer operations. It exfiltrates browser credentials, Keychain data, and files, sending stolen data via HTTP POST to a C2 and to Telegram channels/bots using an unsigned Mach-O Python-based binary.

Keypoints

MacStealer is a macOS-focused stealer affecting Catalina and newer on Intel M1/M2 CPUs.
The malware can extract passwords, cookies, and credit card data from Firefox, Chrome, and Brave, plus a wide range of file types and the macOS Keychain database (base64 encoded).
infection starts with a .DMG distribution that prompts the user with a fake password dialog to harvest credentials.
Data is collected, archived (ZIP), and exfiltrated to a C2 via a POST request, and also transmitted to Telegram channels and a private bot.
The binary is an unsigned Mach-O compiled from Python code, with dependencies shown in the analysis.
The malware is advertised on dark web forums and appears to be mass-produced for broader distribution.

MITRE Techniques

[T1059.006] Python – The Mach-O file is compiled from Python code – “The Mach-O file is compiled from Python code (figures 5 and 6).”
[T1071.001] Web Protocols – C2 communications via Telegram channels and HTTP POSTs – “Simultaneously, the stealer transmits selected information to the listed Telegram channels.”
[T1560.001] Archive Collected Data – Data is zipped before exfiltration – “The stealer then ZIPs up the data and sends it to C2 via a POST request…”
[T1041] Exfiltration Over C2 Channel – Data exfiltrates to C2 and Telegram channels – “sending a POST request” and “Transmits selected information to Telegram channels”
[T1132] Data Encoding – KeyChain data is base64 encoded – “Extract KeyChain database (base64 encoded)”
[T1036] Masquerading – Fake password prompt to deceive the user – “fake password prompt”
[T1070.004] Indicator Removal on Host – Deletes data and ZIP after exfiltration – “It deletes the data and ZIP file from the victim’s system during a subsequent mop-up operation.”

Indicators of Compromise

[File] context – weed.dmg – distribution file used to spread MacStealer
[SHA256] context – e51416f12f8c60e7593bef8b9fc55e04990aa047ad7e8abc22b511e7eb7586f6, 1b5ef101ac0b3c0c98874546ec4277e6a926c36733ab824cece9212373559818
[Mach-O] context – 6a4f8b65a568a779801b72bce215036bea298e2c08ec54906bb3ebbe5c16c712
[C2 URL] context – hxxp[:]//mac[.]cracked23[.]site/uploadLog
[C2 domain] context – mac[.]cracked23[.]site
[C2 IP] context – 89[.]116[.]236[.]26
[Telegram] context – hxxps[:]//t[.]me/macos_stealer_2023, hxxps[:]//t[.]me/macos_logsbot
[Domain/URLs] context – mac[.]cracked23[.]site (same domain referenced across samples)