Article Details
Scrape Timestamp (UTC): 2024-08-16 08:33:58.414
Source: https://thehackernews.com/2024/08/new-banshee-stealer-targets-100-browser.html
Original Article Text
Click to Toggle View
New Banshee Stealer Targets 100+ Browser Extensions on Apple macOS Systems. Cybersecurity researchers have uncovered new stealer malware that's designed to specifically target Apple macOS systems. Dubbed Banshee Stealer, it's offered for sale in the cybercrime underground for a steep price of $3,000 a month and works across both x86_64 and ARM64 architectures. "Banshee Stealer targets a wide range of browsers, cryptocurrency wallets, and around 100 browser extensions, making it a highly versatile and dangerous threat," Elastic Security Labs said in a Thursday report. The web browsers and crypto wallets targeted by the malware comprise Google Chrome, Mozilla Firefox, Brave, Microsoft Edge, Vivaldi, Yandex, Opera, OperaGX, Exodus, Electrum, Coinomi, Guarda, Wasabi Wallet, Atomic, and Ledger. It's also equipped to harvest system information and data from iCloud Keychain passwords and Notes, as well as incorporate a slew of anti-analysis and anti-debugging measures to determine if it's running in a virtual environment in an attempt to evade detection. Furthermore, it makes use of the CFLocaleCopyPreferredLanguages API to avoid infecting systems where Russian is the primary language. Like other macOS malware strains such as Cuckoo and MacStealer, Banshee Stealer also leverages osascript to display a fake password prompt to trick users into entering their system passwords for privilege escalation. Among the other notable features include the ability to collect data from various files matching .txt, .docx, .rtf, .doc, .wallet, .keys, and .key extensions from the Desktop and Documents folders. The gathered data is then exfiltrated in a ZIP archive format to a remote server ("45.142.122[.]92/send/"). "As macOS increasingly becomes a prime target for cybercriminals, Banshee Stealer underscores the rising observance of macOS-specific malware," Elastic said. The disclosure comes as Hunt.io and Kandji detailed another macOS stealer strain that leverages SwiftUI and Apple's Open Directory APIs for capturing and verifying passwords entered by the user in a bogus prompt displayed in order to complete the installation process. "It begins by running a Swift-based dropper that displays a fake password prompt to deceive users," Broadcom-owned Symantec said. "After capturing credentials, the malware verifies them using the OpenDirectory API and subsequently downloads and executes malicious scripts from a command-and-control server." This development also follows the continued emergence of new Windows-based stealers such as Flame Stealer, even as fake sites masquerading as OpenAI's text-to-video artificial intelligence (AI) tool, Sora, are being used to propagate Braodo Stealer. Separately, Israeli users are being targeted with phishing emails containing RAR archive attachments that impersonate Calcalist and Mako to deliver Rhadamanthys Stealer.
Daily Brief Summary
Cybersecurity researchers have identified a new malware known as Banshee Stealer, which targets Apple macOS systems to steal data.
Banshee Stealer is specialized in extracting information from various browsers, cryptocurrency wallets, and about 100 specific browser extensions.
The malware is being sold in cybercrime forums for $3,000 per month and includes capabilities to run on both x86_64 and ARM64 macOS architectures.
Among other functionalities, it can harvest data from the iCloud Keychain, passwords, Notes, and various document types, then sends this data to a remote server.
Banshee includes sophisticated evasion techniques, such as checks to avoid running on systems with Russian as the primary language and mechanisms to determine if it's being analyzed in a virtual environment.
The malware also employs deceptive tactics such as displaying a fake password prompt to trick users into providing their system passwords for further privileges.
This discovery highlights the increasing focus of cybercriminals on macOS users, a trend accompanied by parallel developments in other types of macOS and Windows-based stealer malware.