MonetaStealer Malware Powered with AI Code Attacking macOS Users in the Wild
## Cybersecurity: MonetaStealer Malware Targeting macOS Users
Cybersecurity: MonetaStealer Malware Targeting macOS Users
MonetaStealer, a new information-stealing malware, has been identified targeting macOS users using deceptive file disguises and social engineering tactics. Security researchers at Iru discovered this threat on January 6, 2026, through a suspicious Mach-O binary disguised as a Windows executable file named Portfolio_Review.exe.
The malware is engineered to extract sensitive information from infected macOS systems, including:
Browser passwords Cryptocurrency wallet data Wi-Fi credentials SSH keys Financial documents
MonetaStealer ensures execution exclusively on macOS by checking the system platform using the command if sys.platform != 'darwin' . The malware's reliance on machine learning-generated code suggests it is in early development phases.
Despite being incomplete, MonetaStealer achieved a zero-detection rate on VirusTotal at the time of its discovery, indicating invisibility to most security solutions.
MonetaStealer, a new information-stealing malware, has been identified targeting macOS users using deceptive file disguises and social engineering tactics.
The main payload, identified as portfolio_app.pyc, is concealed within a PyInstaller-compiled binary. This Python-based malware uses a compressed CArchive structure to bypass basic static file scanners. Decompilation revealed Russian-language comments and no obfuscation, indicating a focus on functionality over stealth.
During execution, the malware displays a banner reading "PROFESSIONAL MACOS STEALER v2.0" and uses print statements to track its progress through various data theft modules.
MonetaStealer targets Google Chrome browser data by creating temporary copies of SQLite databases to circumvent file locks. It retrieves the Base64 master key stored in the macOS Keychain using the command security find-generic-password -w -a "Chrome" , necessary for decrypting saved passwords.
This action prompts a system request for the user's keychain password, potentially alerting vigilant users. Upon access, the malware queries login credentials, session cookies, and browsing history using targeted SQL commands.
The cookie theft module utilizes keyword filtering to identify high-value targets, searching for terms such as “bank,” “crypto,” “exchange,” and “paypal” within cookie host names. This focus allows the malware to prioritize financial and cryptocurrency platform sessions.
print('[+] Stealing Chrome cookies...') try: host, name, path, encrypted_value = row if any((keyword in host.lower() for keyword in ['bank', 'crypto', 'exchange', 'paypal'])) and self.stolen_data['browser']['cookies'].append({'host': host, 'name': name, 'path': path}): pass conn.close() except Exception as e: print (f' X Error: {e}')
The malware also extracts browsing history, including URLs, page titles, and visit frequencies, which can indicate user interests and potential targets for additional attacks. All collected browser data is stored in the malware's internal dictionary for later exfiltration through a Telegram bot infrastructure named "b746_mac_collector_bot" with bot ID 8384579537.
Based on reporting by Cyber Security News.