Banshee Stealer is a macOS-focused infostealer that surfaced as a Russian-operated malware-as-a-service in August 2024, targeting browsers, crypto wallets, browser extensions including 2FA tools, and the macOS Keychain on both Intel and Apple Silicon Macs. It is notable for an unusually high subscription price, a late-November 2024 source-code leak that effectively ended the original operation, and a variant that evaded most antivirus for roughly two months by reusing the same string-encryption algorithm Apple’s own XProtect uses.
Overview
Banshee was promoted on underground forums as a macOS MaaS. Elastic Security Labs reported a subscription of $3,000 per month — high for a macOS stealer — while some press cited around $1,500; present it as a range. Early builds included a Russian-language locale check that halted on Russian-language systems; a later variant removed that check, which Check Point read as target expansion.
A late-2024 variant encrypted its strings with the same algorithm Apple uses in XProtect, its built-in anti-malware engine. Reusing a trusted algorithm helped the sample evade most antivirus for roughly two months.
Timeline
- Aug 2024. Advertised and documented by Elastic Security Labs.
- Late 2024. Variant adds XProtect-style string encryption.
- 23 Nov 2024. Source code leaked on the XSS forum; the operators shut the MaaS down.
- Jan 2025. Check Point publishes a retrospective and notes continuing post-leak campaigns.
Technical Capabilities
- Steals data from a wide range of browsers and roughly 100 browser extensions, including crypto-wallet and 2FA extensions. T1555.003 T1539
- Cryptocurrency wallet theft and macOS Keychain access. T1555.001
- Captures the login password via a fake system password prompt to unlock the Keychain. T1056.002
- Collects Notes content and full system information; anti-analysis via fake dialogs and anti-debugging. T1497
Delivery
Banshee spread through phishing websites and fake GitHub repositories impersonating popular software such as Chrome and Telegram, some padded with fake stars and reviews for credibility. T1036 T1566
MITRE ATT&CK Mapping
Banshee has no official ATT&CK Software entry; the techniques below are analyst-mapped from documented behaviour.
| Tactic | Technique | Usage |
|---|---|---|
| Credential Access | T1555.001 Keychain | Keychain theft |
| Credential Access | T1555.003 Web Browsers | Saved logins |
| Collection | T1056.002 GUI Input Capture | Fake password prompt |
| Defense Evasion | T1027 Obfuscated Files | XProtect-style string encryption |
| Defense Evasion | T1036 Masquerading | Fake GitHub repos and apps |
Detection & Mitigation
- Alert on
osascriptfake-password dialogs (display dialog with a hidden answer or “password” text); expect some false positives from legitimate IT prompts. - Monitor
securityanddscluse and Keychain enumeration following such a prompt. - Distrust GitHub repositories with inflated stars; install only from trusted sources; enforce Gatekeeper and notarization.
- Note the “100 million Apple users” figure in press is install-base framing, not a victim count.
Defend macOS Fleets
Mjolnir Security helps organisations detect macOS stealers and the credential theft they enable.
- Managed Detection and Response macOS coverage for fake-password prompts, Keychain enumeration and browser-store access.
- Threat Hunting as a Service Hunting for osascript social-engineering chains and malicious DMG delivery.
- 24/7 Incident Response Containment and credential rotation when macOS stealer activity is detected. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts