Flashpoint Intel Team analysts identified four prominent strains dominating the current threat landscape: Atomic Stealer, recognized as the most prevalent Malware-as-a-Service offering; Poseidon Stealer, a sophisticated variant with connections to Atomic’s development team; Cthulu, another significant MaaS platform; and Banshee, contributing to the expanding ecosystem. These sophisticated infostealers are rapidly evolving to exploit macOS environments with unprecedented precision, targeting valuable data including browser credentials, cookies, and autofill information that serve as gateways for ransomware groups and initial access brokers. This technical sophistication, combined with the rapid evolution of detection evasion techniques, positions macOS infostealers as a formidable threat requiring immediate organizational attention and enhanced security measures. The malware’s primary objective centers on harvesting browser-stored data, host information, and installed application details, creating comprehensive digital fingerprints of infected systems. The malware typically targets Safari’s keychain entries, Chrome’s Local State files, and Firefox’s logins.json databases, systematically harvesting stored credentials before transmission to remote infrastructure. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. The cybersecurity landscape is witnessing an alarming surge in macOS-targeted information-stealing malware, marking a significant shift from the traditional Windows-centric threat model. The system_profiler SPHardwareDataType command reveals system specifications, while system_profiler SPApplicationsDataType catalogs installed applications, providing attackers with detailed reconnaissance data. These families collectively process over 300 million credential sets monthly, with approximately 50 million unique credentials and 6 million never-before-seen entries captured across 1.5 million infected hosts. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. Data exfiltration occurs through HTTP POST requests to command-and-control servers, with collected information compressed using standard archiving utilities.
This Cyber News was published on cybersecuritynews.com. Publication date: Sat, 12 Jul 2025 04:55:13 +0000