SUMMARY
- Banshee Stealer targets macOS users, distributed via fake GitHub repositories and phishing sites.
- The malware steals browser credentials, cryptocurrency wallets, 2FA codes, and system details.
- It evades detection using Apple’s XProtect algorithm and deceptive system pop-ups.
- Threat actors expanded targets by removing regional restrictions in the malware.
- Source code leaked in November 2024, but risks remain with evolving cyber threats.
Cybersecurity researchers at Check Point detected a new version of Banshee Stealer in late September 2024, distributed via phishing websites and fake GitHub repositories. According to their investigation, shared exclusively with Hackread.com this infostealer resembles popular software like Google Chrome, Telegram, and TradingView.
For your information, Banshee macOS Stealer targets macOS users and steals browser credentials, cryptocurrency wallets, and other sensitive data. It was first detected by Elastic Security Labs in August 2024 and was advertised on underground forums like XSS, Exploit, and Telegram, as a “stealer-as-a-service”.
This newly discovered version includes a string encryption algorithm “stolen” from Apple’s own XProtect antivirus engine, which allowed it to evade detection for over two months. In addition, it doesn’t include its Russian language check, which was previously used to prevent the malware from targeting specific regions, indicating an expansion in its potential targets.
Check Point has identified multiple campaigns distributing the malware through phishing websites, although it’s unclear if they are carried out by previous customers. Threat actors utilized GitHub repositories for Banshee distribution, targeting macOS users with Banshee and Windows users with Lumma Stealer. Malicious repositories were created over three waves, appearing legitimate with stars and reviews, and luring users into downloading malware
Banshee Stealer can harvest data from web browsers, cryptocurrency wallets, and files with specific extensions, including stealing login credentials from web browsers like Chrome, Brave, Edge, and Vivaldi. It also targets browser extensions, specifically those for cryptocurrency wallets, potentially compromising your digital assets.
Additionally, it can capture your Two-Factor Authentication (2FA) credentials, bypassing an extra layer of security for your accounts. Furthermore, it drains off software and hardware details from your device, along with your external IP address and macOS passwords, giving attackers a complete picture of your system.
Also, Banshee Stealer utilizes deceptive pop-ups that mimic legitimate system prompts. These pop-ups can trick you into unknowingly revealing your macOS password, granting the malware administrative access to your system. The malware employs anti-analysis techniques to avoid detection by security tools.
This makes it difficult to identify its presence on your device using traditional methods. Once stolen, your data is sent to the attacker’s command-and-control servers through encrypted and encoded channels, making it challenging to track or intercept. Its source code leaked online in November 2024, leading to its shutdown. Still, it highlights how cyber threats are evolving continually.
“Businesses must recognize the broader risks posed by modern malware, including costly data breaches that compromise sensitive information and damage reputations, targeted attacks on cryptocurrency wallets that threaten digital assets, and operational disruptions caused by stealthy malware that evades detection and inflicts long-term harm before being identified,” CPR researchers noted in the blog post.
Ms. Ngoc Bui, Cybersecurity Expert at Menlo Security, a Mountain View, Calif.-based provider of browser security commented on the latatest development stating, “This new Banshee Stealer variant exposes a critical gap in Mac security. While companies are increasingly adopting Apple ecosystems, the security tools haven’t kept pace. Even leading EDR solutions have limitations on Macs, leaving organizations with significant blind spots. We need a multi-layered approach to security, including more trained hunters on Mac environments.“
RELATED TOPICS
- Fake Google Meet Alerts Install Malware on Windows, macOS
- “HM Surf” macOS Flaw Lets Attackers Access Camera and Mic
- Hackers Could Exploit Microsoft Teams on macOS to Steal Data
- TodoSwift Malware Targets macOS, Disguised as Bitcoin PDF App
- Lazarus Group Hits macOS with RustyAttr Trojan in Fake Job PDFs
