Banshee' info-stealing malware uses Apple's XProtect string encryption to steal crypto. This may have let the malware slip by some antivirus programs, according to new research.

Banshee macOS Stealer gained attention in mid-2024, promoted as a “stealer-as-a-service” on forums like XSS, Exploit, and Telegram. Threat actors could buy it for $3,000 to target macOS users.

In this case, Checkpoint security has identified a malware-as-a-service attack it calls Banshee macOS Stealer. This insidious attack, which has apparently now been closed down, was spread via seemingly legitimate browser downloads distributed outside of Apple’s Mac App Store.