MacStealer
MacStealer is a macOS-focused information stealer observed in 2023 and referenced alongside other emerging macOS infostealer families such as Atomic Stealer, Pureland, RealStealer, RustBucket, DazzleSpy, and MacSync Stealer. The provided content identifies it as malware used to target macOS users, but does not supply high-confidence technical details about its internal functionality, persistence, command-and-control infrastructure, specific infection chain, or indicators of compromise unique to MacStealer itself. The content does state that attackers have used social-engineering tactics, including abusing ChatGPT-themed lures, to trick Mac users into installing MacStealer. Based on the available material, MacStealer should be characterized as a macOS-targeting infostealer family seen in 2023, but further behavioral and IOC-level enrichment is not available in the provided content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
8 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
1 technique
Execution
Credential Access
3 techniques
Credential Access
Once achieved, a bogus password prompts users in an attempt to steal their real password. MacStealer then saves the password in the affected system’s temporary folder (TMP).
Collection
3 techniques
Collection
The malware then proceeds to collect and save the following... Cryptocurrency wallets... Various files (.TXT, .DOC, .DOCX, .PDF, .XLS, .XLSX, .PPT, .PPTX, .JPG, .PNG, .CVS, .BMP, .MP3, .ZIP, .RAR, .PY, .DB) System information in text form
Command and Control
1 technique
Command and Control
Exfiltration
1 technique
Exfiltration
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
MacStealer is a stealer malware targeting Mac users, typically distributed through social engineering tactics such as tricking users into running malicious commands.
Named as one of several new macOS infostealer families observed in 2023.
A macOS-specific infostealer mentioned as being offered for sale in crimeware forums.
Previously, there have been several cases where Threat Actors have targeted macOS users with various families of malware, including MacStealer, RustBucket, DazzleSpy, etc.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.