Banshee' info-stealing malware uses Apple's XProtect string encryption to steal crypto. This may have let the malware slip by some antivirus programs, according to new research.

Security researchers from Check Point Research recently find new variant of Banshee malware The new variant uses encryption that allows it to blend with regular macOS operations The campaign went unabated for two months Cybersecurity researchers from Check Point Research recently uncovered a new version of the Banshee infostealer,

Banshee macOS Stealer gained attention in mid-2024, promoted as a “stealer-as-a-service” on forums like XSS, Exploit, and Telegram. Threat actors could buy it for $3,000 to target macOS users.

In this case, Checkpoint security has identified a malware-as-a-service attack it calls Banshee macOS Stealer. This insidious attack, which has apparently now been closed down, was spread via seemingly legitimate browser downloads distributed outside of Apple’s Mac App Store.

Check Point Research (CSR) announced that it discovered a more sophisticated version of the Banshee Stealer malware. It warned that businesses must be careful as hackers could use it to “compromise sensitive information and damage reputations.

Banshee Stealer, a $3,000/month macOS malware, resurfaces with XProtect encryption, targeting 100M users via phishing campaigns.