Banshee: The Stealer That "Stole Code" From MacOS XProtect
Essential information
- Published
- 09/01/2025 15:08
- Modified
- 09/01/2025 15:41
- Tags
- 2025-01-09 banshee cryptocurrency github lumma stealer macos phishing string encryption xprotect
- Related entities
- 25 observables, 1 intrusion sets (apt), 22 techniques (mitre), 2 malware
Description
A new version of the Banshee macOS stealer, linked to Russian-speaking cybercriminals, has been monitored since September. This version went undetected for over two months, using a string encryption algorithm identical to Apple's XProtect antivirus engine. The malware targets browser credentials, cryptocurrency wallets, and sensitive information. It was distributed through malicious GitHub repositories and phishing websites, often masquerading as popular software. The Banshee stealer-as-a-service operation, priced at $3,000, was advertised on Telegram and dark web forums before shutting down in November 2024 due to source code leakage. Despite this, threat actors continue to distribute updated versions, highlighting the growing trend of targeting macOS users.