New macOS Malware Targets Crypto

Sydney, Aug 17: A new macOS-specific malware called BANSHEE Stealer emerged, drawing significant attention from the cybersecurity community.
Allegedly developed by Russian threat actors, this sophisticated infostealer was introduced on an underground forum and is engineered to target both x86_64 and ARM64 macOS architectures, making it highly versatile and dangerous.
BANSHEE Stealer is particularly concerning due to its ability to extract sensitive information, including system details, browser data, and cryptocurrency wallets.
The malware’s high monthly subscription cost of $3,000 is noteworthy, positioning it as one of the more expensive tools in the cybercriminal marketplace, especially when compared to other well-known stealers like AgentTesla.

This malware exemplifies the growing trend of cyber threats specifically targeting macOS, a platform traditionally seen as more secure than its Windows counterpart.
As macOS becomes increasingly popular, cybercriminals are paying closer attention, developing more advanced tools to exploit its user base.

BANSHEE Stealer is notable for retaining all the C++ symbols in its code, which allows analysts to gain insights into its structure.
The malware is composed of several key components that manage core tasks such as anti-debugging measures, language checks, data collection, and exfiltration.
These components work together to carry out BANSHEE Stealer’s malicious objectives, making it a potent tool for cybercriminals targeting macOS users.

The malware employs basic yet effective techniques to evade detection.
It uses the sysctl API to detect debugging attempts and checks for virtualisation by identifying specific strings in the hardware model identifier.
Additionally, it avoids infecting systems where Russian is the primary language by checking the user’s language settings.

Despite these evasion techniques, the malware’s methods are relatively simple and can be circumvented by advanced sandboxes and malware analysts.
BANSHEE Stealer collects extensive system information using specific functions, which serialise this data into a JSON object.

It also executes AppleScripts to prompt users to enter their passwords, which are then validated and stored for later use. These credentials can potentially be used to decrypt keychain data, granting access to all saved passwords on the system.

The malware targets data from nine different web browsers, including Chrome, Firefox, and Safari. It collects browser history, cookies, login credentials, and data from around 100 browser plugins. In terms of cryptocurrency wallets, the malware targets popular options like Exodus, Electrum, and Ledger, storing the collected data in a temporary directory before exfiltration.
Once the data collection process is complete, BANSHEE Stealer compresses the files, encrypts them using XOR, and encodes them in base64 before sending them to a remote server via a post request.
This sophisticated exfiltration method ensures that the stolen data is securely transmitted to the attacker.

To aid in detecting this malware, Elastic Security has developed YARA rules specifically designed to identify BANSHEE Stealer’s activity.
These rules are crucial for security teams aiming to protect their systems from this emerging threat.
BANSHEE Stealer represents a significant threat to macOS users, with its ability to collect extensive data from the system, browsers, and cryptocurrency wallets.

While the malware’s design is not overly complex, its focus on macOS systems and the breadth of data it can gather make it a serious concern for the cybersecurity community.
As macOS continues to grow in popularity, so too does the attention it receives from cybercriminals, making vigilance and preparedness more important than ever.