{"id":98579,"date":"2023-08-04T10:59:38","date_gmt":"2023-08-04T17:59:38","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=98579"},"modified":"2024-03-13T09:59:51","modified_gmt":"2024-03-13T16:59:51","slug":"mac-stealer-malware-realst-disguises-itself-as-video-games-is-macos-sonoma-ready","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/mac-stealer-malware-realst-disguises-itself-as-video-games-is-macos-sonoma-ready\/","title":{"rendered":"Mac stealer malware Realst disguises itself as video games, is macOS Sonoma-ready"},"content":{"rendered":"

\"\"<\/p>\n

In early July, malware researcher iamdeadlyz wrote up a detailed report about some new Mac malware dubbed Realst Stealer. Since at least last year, iamdeadlyz has been researching RedLine Stealer, PureLand<\/a>, and related malware that steals cryptocurrency.<\/p>\n

Several people had reported to iamdeadlyz about a variety of fake video games. Each one looks legitimate on the surface; they have their own Twitter and YouTube accounts, Discord servers, blogs, and more. It turns out that these supposed games are in fact Trojan horse malware. It appears that the same malware gang developed the latest fake games as well.<\/p>\n

Some, but not all, of the games are allegedly built on various blockchains or self-describe as NFT games. Blockchains<\/a> and non-fungible tokens (NFTs)<\/a> are technologies that are typically of interest to people who own cryptocurrency. Thus, the developers of these fake games target individuals who are likely to have crypto wallets.<\/p>\n

What does Realst Stealer malware do?<\/h3>\n

The primary goal of Realst Stealer seem to be robbing cryptocurrency wallets on infected Macs. Realst targets at least ten different crypto wallet browser extensions.<\/p>\n

But even if a victim isn’t interested in blockchains or NFTs, the Trojan malware will attempt to exfiltrate their macOS Keychain. It also targets Telegram<\/a> data, if the user has the messaging app installed on their Mac.<\/p>\n

Realst Stealer targets every popular Mac browser<\/a>, with two surprising exceptions: Apple’s Safari and Microsoft Edge. Safari’s omission seems understandable; perhaps the developers are more accustomed to writing Windows malware. But Edge’s omission is a bit of a mystery; after all, it’s bundled with Windows, and it’s Chromium-based, like most of the other browsers Realst targets.<\/p>\n

The malware specifically targets Google Chrome, Mozilla Firefox, Brave, Opera, Opera GX (a “gaming browser”), and Vivaldi.<\/p>\n

Which games does Realst Stealer masquerade as?<\/h3>\n

Some of the known Trojan horse games’ names are as follows:<\/p>\n