Stealer Crossing: New Horizons

The talk opens with the rise of macOS infostealers in 2024, which target browser data, saved passwords, keychain contents, and cryptocurrency wallets, and which often reach victims through cracked software, fake installers, and poisoned search results. The speakers note that leaked stealer dumps help show the real impact, and that stolen data feeds initial access for later ransomware activity.

The core of the session walks through several families. Poseidon relies heavily on AppleScript and a base32-encoded payload, and its web panel exposed unprotected admin routes. Banshee moved between C++ and Objective-C builds and protected its strings with a per-string XOR scheme. AMOS has cycled through many packers and eventually wrapped a Poseidon-style AppleScript payload in a custom base64 alphabet. Cthulu's Go source was recovered from a binary, and its exfiltration relied on free file-sharing sites and an open database. A North Korean stealer, RustDoor, is covered briefly for its launch agent persistence. Across these, the payloads are often similar code with new wrappers.

For detection, the speakers recommend behavioral approaches using endpoint security telemetry. They focus on process trees where a stealer-like application spawns osascript, a shell, dscl for password validation, or system_profiler. Their takeaway is that wrappers change often while the underlying AppleScript and command patterns stay consistent, and that the tool name should not be read as the identity of the operator.