macOS Stealers: Stealing Your Coins, Cookies and Keychains

The talk opens by explaining why macOS infostealers matter to criminal operators. Windows still holds roughly 70 percent of devices worldwide, so Mac-capable stealers extend reach into the rest of the market. The speakers note that Mac stealers rent for far more than Windows ones because supply is thin. They walk through how these DMG-delivered tools get past Gatekeeper, sometimes with a terminal command that strips quarantine attributes, then prompt for a password and harvest keychains, browser data and crypto wallet material.

The middle section traces the operators behind the wave. Amos, which appeared in 2023, prompted copycats, and several former customers later launched their own stealers. The speakers cover a timeline of rebrands, exits and retirements, then the delivery side: SEO poisoning, malvertising, fake games, fake job offers, malicious IDE extensions and a vishing campaign that hijacked a router's DNS settings. Lures targeted IT staff, crypto users and gamers.

The technical centrepiece examines Cuckoo stealer, which adds remote command capabilities beyond data theft. Its three C2 protocols cover configuration retrieval and exfiltration, a backdoor channel for shell commands and reboots, and a file operations channel. The speakers highlight elliptic curve key exchange, the privacy prompt for desktop access, and muting the volume to hide that prompt. They link the developer to a Windows stealer, then close by expecting the same delivery tactics and rat-like features to spread into broader commodity malware.