{"id":98878,"date":"2023-09-22T15:28:13","date_gmt":"2023-09-22T22:28:13","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=98878"},"modified":"2024-08-08T19:11:19","modified_gmt":"2024-08-09T02:11:19","slug":"mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september\/","title":{"rendered":"Mac data-stealer malware roundup: AtomicStealer, MetaStealer, Realst all active in September"},"content":{"rendered":"<p><img loading=\"lazy\" class=\"aligncenter size-full wp-image-97908\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2023\/05\/cryptocurrency-and-cookie-stealing-malware-600x400-1.jpg\" alt=\"\" width=\"600\" height=\"400\" \/><\/p>\n<p>Intego is currently preparing an exclusive write-up on a new macOS data-stealer malware campaign. But while we prepare to publish that piece, we wanted to share highlights of some other recent developments regarding data-stealing malware families on the Mac.<\/p>\n<p>Here are some quick updates about three macOS stealer malware families: AtomicStealer, MetaStealer, and Realst Stealer.<\/p>\n<p><em>In this article:<\/em><\/p>\n<ul>\n<li><a href=\"#atomic\">AtomicStealer update: a recent Google Ads campaign<\/a><\/li>\n<li><a href=\"#meta\">MetaStealer being used in targeted attacks for months<\/a><\/li>\n<li><a href=\"#realst\">Realst Stealer update: project may be actively recruiting<\/a>\n<ul>\n<li><a href=\"#realstsus\">Many Realst promo accounts still not suspended<\/a><\/li>\n<\/ul>\n<\/li>\n<li><a href=\"#how-to-remove\">How can one remove or prevent Mac stealer malware?<\/a><\/li>\n<li><a href=\"#learnmore\">How can I learn more?<\/a><a name=\"atomic\"><\/a><\/li>\n<\/ul>\n<h3>AtomicStealer update: a recent Google Ads campaign<\/h3>\n<p>According to a September 6 <a href=\"https:\/\/www.malwarebytes.com\/blog\/threat-intelligence\/2023\/09\/atomic-macos-stealer-delivered-via-malvertising\" target=\"_blank\" rel=\"noopener nofollow\">write-up<\/a> by J\u00e9r\u00f4me Segura, a recent Google Ads campaign appeared to have pushed AtomicStealer malware (also known as AMOS or AtomStealer).<\/p>\n<p>The malicious Goodle Ads campaign targeted people searching for TradingView, a multi-platform app for tracking &#8220;stocks, currencies, cryptos, futures, CFDs and more.&#8221;<\/p>\n<p>A lookalike site was set up that was nearly identical to the real TradingView Desktop download page. If victims clicked on the Windows download link, they would get an installer for Windows RAT malware called NetSupport. And if victims clicked on the Mac download link, they would get AtomicStealer instead.<\/p>\n<p>As we mentioned in <a href=\"https:\/\/www.intego.com\/mac-security-blog\/atomic-stealer-thieving-mac-malware-sold-via-telegram\/\">our May 2023 write-up about AtomicStealer<\/a>, it attempts to exfiltrate a lot of highly sensitive data from infected Macs. This includes passwords, stay-logged-in session cookies, and cryptocurrency wallets, among other things. Check out our previous coverage here:<\/p>\n<blockquote class=\"wp-embedded-content\" data-secret=\"U0QBPfFXu8\"><p><a href=\"https:\/\/www.intego.com\/mac-security-blog\/atomic-stealer-thieving-mac-malware-sold-via-telegram\/\">Atomic Stealer: Thieving Mac malware sold via Telegram<\/a><\/p><\/blockquote>\n<p><iframe class=\"wp-embedded-content\" sandbox=\"allow-scripts\" security=\"restricted\" style=\"position: absolute; clip: rect(1px, 1px, 1px, 1px);\" title=\"&#8220;Atomic Stealer: Thieving Mac malware sold via Telegram&#8221; &#8212; The Mac Security Blog\" src=\"https:\/\/www.intego.com\/mac-security-blog\/atomic-stealer-thieving-mac-malware-sold-via-telegram\/embed\/#?secret=U0QBPfFXu8\" data-secret=\"U0QBPfFXu8\" width=\"500\" height=\"282\" frameborder=\"0\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\"><\/iframe><\/p>\n<p><a name=\"meta\"><\/a><\/p>\n<h3>MetaStealer being used in targeted attacks for months<\/h3>\n<p>In a September 11 <a href=\"https:\/\/www.sentinelone.com\/blog\/macos-metastealer-new-family-of-obfuscated-go-infostealers-spread-in-targeted-attacks\/\" target=\"_blank\" rel=\"noopener nofollow\">write-up<\/a>, Phil Stokes shares recent research into MetaStealer, a very similar family of data-stealing malware.<\/p>\n<p>MetaStealer has recently been distributed as a Trojan horse masquerading as Adobe Photoshop, PDF files, and even TradingView\u2014just like the recent AtomicStealer campaign.<\/p>\n<p>But unlike the recent AtomicStealer campaign, MetaStealer appears tends to be used in more targeted attacks, specifically targeting businesses. Stokes notes that one VirusTotal user who uploaded a sample several months ago left a <a href=\"https:\/\/www.virustotal.com\/gui\/user\/Nora88\/comments\" target=\"_blank\" rel=\"noopener\">comment<\/a> indicating how she ended up with the malware:<\/p>\n<blockquote><p>&#8220;I was targeted by someone posing as a design client, and didn&#8217;t realize anything was out of the ordinary. The man I&#8217;d been negotiating with on the job this past week sent me a password protected zip file containing this DMG file, which I thought was a bit odd.<\/p>\n<p>&#8220;Against my better judgement I mounted the image to my computer to see its contents. It contained an app that was disguised as a PDF, which I did not open and is when I realized he was a scammer.&#8221;<\/p><\/blockquote>\n<div id=\"attachment_98896\" style=\"width: 510px\" class=\"wp-caption aligncenter\"><img aria-describedby=\"caption-attachment-98896\" loading=\"lazy\" class=\"wp-image-98896\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2023\/09\/MetaStealer-fake-PDF.jpg\" alt=\"\" width=\"500\" height=\"320\" \/><p id=\"caption-attachment-98896\" class=\"wp-caption-text\">A fake PDF on a mounted disk image; it&#8217;s actually a MetaStealer Trojan horse.<\/p><\/div>\n<p>Some samples of MetaStealer seem to focus on stealing Telegram data, as well as data from Meta apps\u2014hence the malware&#8217;s nickname.<a name=\"realst\"><\/a><\/p>\n<h3>Realst Stealer update: project may be actively recruiting<\/h3>\n<p>Photographer and artist Stu Sontier (<a href=\"https:\/\/twitter.com\/stusontier\" target=\"_blank\" rel=\"noopener\">@stusontier<\/a>) reached out to us with a follow-up regarding on <a href=\"https:\/\/www.intego.com\/mac-security-blog\/mac-stealer-malware-realst-disguises-itself-as-video-games-is-macos-sonoma-ready\/\">our article on Realst malware<\/a>:<\/p>\n<blockquote class=\"wp-embedded-content\" data-secret=\"ZeceqGUGZj\"><p><a href=\"https:\/\/www.intego.com\/mac-security-blog\/mac-stealer-malware-realst-disguises-itself-as-video-games-is-macos-sonoma-ready\/\">Mac stealer malware Realst disguises itself as video games, is macOS Sonoma-ready<\/a><\/p><\/blockquote>\n<p><iframe class=\"wp-embedded-content\" sandbox=\"allow-scripts\" security=\"restricted\" style=\"position: absolute; clip: rect(1px, 1px, 1px, 1px);\" title=\"&#8220;Mac stealer malware Realst disguises itself as video games, is macOS Sonoma-ready&#8221; &#8212; The Mac Security Blog\" src=\"https:\/\/www.intego.com\/mac-security-blog\/mac-stealer-malware-realst-disguises-itself-as-video-games-is-macos-sonoma-ready\/embed\/#?secret=ZeceqGUGZj\" data-secret=\"ZeceqGUGZj\" width=\"500\" height=\"282\" frameborder=\"0\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\"><\/iframe><\/p>\n<p>Sontier says that he was recently contacted by &#8220;a scammer who DMed me with a &#8216;Love your artwork, do you do commissions&#8217; message.&#8221; He notes that such direct messages often lead to malware &#8220;disguised as collaboration documents.&#8221; Such malware may steal cryptocurrency wallets, among other things. Many users of X\/Twitter and the chat platform Discord have reported receiving direct messages from scammers leading to wallet-stealing malware throughout 2022 and 2023.<\/p>\n<p>This time, Sontier noted that the account that direct-messaged him seemed to be affiliated with a Realst Stealer project. We noted in August that <a href=\"https:\/\/www.intego.com\/mac-security-blog\/mac-stealer-malware-realst-disguises-itself-as-video-games-is-macos-sonoma-ready\/\">Realst disguises itself as video games<\/a>, but its actual intent is to steal cryptocurrency wallets and passwords from victims.<\/p>\n<p>Sontier alerted us to the name of a new Realst-related game title not mentioned in our August article: &#8220;Dash Land Metaworld.&#8221; He noted that accounts on X (formerly known as Twitter), YouTube, Instagram, and Medium were associated with this supposed video game. Sontier thought that the project looked like &#8220;an attempt to resurrect&#8221; Dawn Land Metaworld.<\/p>\n<p>Intego did some further investigation. We uncovered evidence that Dash Land Metaworld accounts were, in fact, renamed and rebranded accounts that had previously been Dawn Land Metaworld-branded.<\/p>\n<p>The rebrand appears to have happened the same week Intego published our Realst expos\u00e9 article.<\/p>\n<p>The @DashMetaLand X account <a href=\"https:\/\/twitter.com\/DashMetaLand\/status\/1686743965997907970\" target=\"_blank\" rel=\"noopener\">most recently posted<\/a> on August 2. That post states, in part, &#8220;We have rebranded our game to increase the activity of the audience, it was a difficult decision but so our game looks more stylish and fresh.&#8221; The post includes a screenshot showing the new logo as &#8220;DashLand MetaWorld&#8221; or &#8220;Dash Land Meta World.&#8221;<\/p>\n<div id=\"attachment_98895\" style=\"width: 510px\" class=\"wp-caption aligncenter\"><img aria-describedby=\"caption-attachment-98895\" loading=\"lazy\" class=\"wp-image-98895 size-full\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2023\/09\/Dash-Land-Metaworld-X-post-20230802.jpg\" alt=\"\" width=\"500\" height=\"493\" \/><p id=\"caption-attachment-98895\" class=\"wp-caption-text\">X post from Realst Stealer malware-affiliated &#8220;Dash Land Metaworld.&#8221;<\/p><\/div>\n<p>The post has replies from a mixture of shill accounts affiliated with the project, as well as other accounts warning that the project is a scam. So far, @DashMetaLand has not posted on X since then.<\/p>\n<p>But based on Sontier&#8217;s report and other evidence, it seems like the project may be ongoing and actively recruiting.<\/p>\n<p>Another bit of evidence that the campaign is still active comes in the form of a newly registered domain name. The @DashMetaLand X profile lists the domain dash-land[.]io in its company Location. This domain was registered on September 12\u2014the day before Sontier intially contacted Intego.<\/p>\n<p>Moreover, we discovered a September 3 <a href=\"https:\/\/www.instagram.com\/p\/CwvilV4razs\/\" target=\"_blank\" rel=\"noopener\">Instagram post<\/a> that seeks to recruit &#8220;game testers&#8221; for &#8220;a new NFT project&#8221; related to DashLand, claiming to offer &#8220;good pay.&#8221;<\/p>\n<div id=\"attachment_98906\" style=\"width: 510px\" class=\"wp-caption aligncenter\"><img aria-describedby=\"caption-attachment-98906\" loading=\"lazy\" class=\"wp-image-98906\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2023\/09\/DashLand-malware-seeking-game-testers-20230903.jpg\" alt=\"\" width=\"500\" height=\"321\" \/><p id=\"caption-attachment-98906\" class=\"wp-caption-text\">Instagram post claiming to seek game testers for &#8220;DashLand Metaverse.&#8221;<\/p><\/div>\n<p>Interestingly, the Instagram account claims the project is based in Japan. This differs from the X account, which claims the project&#8217;s headquarters is a small office building in &#8220;Jers (UK),&#8221; referring to Jersey, a self-governing British Crown Dependency island located between France and the UK.<\/p>\n<div id=\"attachment_98912\" style=\"width: 510px\" class=\"wp-caption aligncenter\"><img aria-describedby=\"caption-attachment-98912\" loading=\"lazy\" class=\"wp-image-98912\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2023\/09\/DashLand-Jersey-office.jpg\" alt=\"\" width=\"500\" height=\"418\" \/><p id=\"caption-attachment-98912\" class=\"wp-caption-text\">An office building in Jersey, supposedly Dash Land&#8217;s headquarters.<\/p><\/div>\n<h4><strong>Many Realst promo accounts still not suspended<\/strong><\/h4>\n<p>Meanwhile, several older accounts affiliated with Realst malware, most of which appear to be inactive since before @DashMetaLand last posted, still have not been suspended.<\/p>\n<div id=\"attachment_98897\" style=\"width: 510px\" class=\"wp-caption aligncenter\"><img aria-describedby=\"caption-attachment-98897\" loading=\"lazy\" class=\"wp-image-98897\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2023\/09\/fake-Mac-games-spread-malware.jpg\" alt=\"\" width=\"500\" height=\"434\" \/><p id=\"caption-attachment-98897\" class=\"wp-caption-text\">Early August 2023 screenshots of X accounts affiliated with Realst Stealer malware.<\/p><\/div>\n<p>On X, for example, @brawlearth, @olympreptiles, @RyzeX_web3, and @WildmenWorld all still exist. (@GuardiansMeta, which appears in the screenshot above, may have been suspended or deleted; the username now belongs to someone else.) All of the accounts have lost followers since early August, but the most dramatic drop by far was @WildmenWorld. It previously had nearly 8,400 followers and now has fewer than 3,900\u2014less than half as many as before. This might indicate that the account&#8217;s followers had been bolstered by bot accounts that X has since suspended; the platform has reportedly <a href=\"https:\/\/twitter.com\/xDaily\/status\/1694779462334959775\" target=\"_blank\" rel=\"noopener\">purged thousands of bot accounts<\/a> within the past month.<a name=\"how-to-remove\"><\/a><\/p>\n<h3>How can one remove or prevent Mac stealer malware?<\/h3>\n<p><img loading=\"lazy\" class=\"alignright size-medium wp-image-54214\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2016\/06\/X9-Mac-Antivirus-Launch-300x150.png\" alt=\"Intego X9 software boxes\" width=\"200\" height=\"100\" srcset=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2016\/06\/X9-Mac-Antivirus-Launch-300x150.png 300w, https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2016\/06\/X9-Mac-Antivirus-Launch-150x75.png 150w, https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2016\/06\/X9-Mac-Antivirus-Launch.png 600w\" sizes=\"(max-width: 200px) 100vw, 200px\" \/><\/p>\n<p>Intego VirusBarrier X9, included with <strong><a href=\"https:\/\/www.intego.com\/mac-protection-bundle\">Intego&#8217;s Mac Premium Bundle X9<\/a><\/strong>, can protect against, detect, and eliminate AtomicStealer, MetaStealer, Realst Stealer, and other varieties of Mac malware too numerous to name here.<\/p>\n<p>If you believe your Mac may be infected\u2014or to prevent future infections\u2014use trusted antivirus software. VirusBarrier is award-winning antivirus software, designed by Mac security experts, that includes <a href=\"https:\/\/www.intego.com\/mac-security-blog\/why-your-antivirus-needs-real-time-scanning\/\">real-time protection<\/a>. It&#8217;s compatible with a variety of Mac hardware and OS versions, including the latest Apple silicon Macs running macOS Sonoma.<\/p>\n<p>Additionally, if you use a Windows PC, <a href=\"https:\/\/www.intego.com\/intego-antivirus\"><strong>Intego Antivirus for Windows<\/strong><\/a> can keep your computer protected from PC malware.<\/p>\n<p><span style=\"font-size: small;\">VirusBarrier X6, X7, and X8 on older Mac OS X versions also provide protection. Note, however, that it is best to upgrade to the latest versions of macOS and VirusBarrier; this will help ensure your Mac gets all the latest security updates from Apple.<a name=\"learnmore\"><\/a><\/span><\/p>\n<h3>How can I learn more?<\/h3>\n<p>Be sure to check out Intego&#8217;s previous coverage of other data-stealer Mac malware from 2023: <a href=\"https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/#other-names\">PureLand<\/a>, <a href=\"https:\/\/www.intego.com\/mac-security-blog\/fakegpt-trojanized-chatgpt-chrome-extension-hijacks-facebook-accounts\/\">FakeGPT<\/a>, <a href=\"https:\/\/www.intego.com\/mac-security-blog\/macstealer-mac-trojan-malware-steals-passwords-wallets-and-files\/\">MacStealer<\/a>, <a href=\"https:\/\/www.intego.com\/mac-security-blog\/atomic-stealer-thieving-mac-malware-sold-via-telegram\/\">AtomicStealer<\/a>, <a href=\"https:\/\/www.intego.com\/mac-security-blog\/shadowvault-is-the-latest-mac-data-stealer-malware-reportedly\/\">ShadowVault<\/a>, and <a href=\"https:\/\/www.intego.com\/mac-security-blog\/mac-stealer-malware-realst-disguises-itself-as-video-games-is-macos-sonoma-ready\/\">Realst<\/a>.<\/p>\n<p>For additional technical details and indicators of compromise (IOCs) for a couple of recent AtomicStealer and MetaStealer campaigns, you can read <a href=\"https:\/\/www.malwarebytes.com\/blog\/threat-intelligence\/2023\/09\/atomic-macos-stealer-delivered-via-malvertising\" target=\"_blank\" rel=\"noopener nofollow\">J\u00e9r\u00f4me Segura&#8217;s write-up<\/a> and <a href=\"https:\/\/www.sentinelone.com\/blog\/macos-metastealer-new-family-of-obfuscated-go-infostealers-spread-in-targeted-attacks\/\" target=\"_blank\" rel=\"noopener nofollow\">Phil Stokes&#8217; write-up<\/a>, respectively.<\/p>\n<p><a href=\"https:\/\/podcast.intego.com\/\" target=\"_blank\" rel=\"noopener\"><img class=\"alignleft\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2021\/04\/intego-podcast-artwork-400.jpg\" alt=\"\" width=\"80\" \/><\/a>Each week on the <a href=\"https:\/\/podcast.intego.com\/\" target=\"_blank\" rel=\"noopener\"><strong>Intego Mac Podcast<\/strong><\/a>, Intego&#8217;s Mac security experts discuss the latest Apple news, including security and privacy stories, and offer practical advice on getting the most out of your Apple devices. Be sure to <a href=\"https:\/\/podcasts.apple.com\/us\/podcast\/intego-mac-podcast\/id1293834627\" rel=\"noopener\"><strong>follow the podcast<\/strong><\/a> to make sure you don\u2019t miss any episodes.<\/p>\n<p>You can also subscribe to our <a href=\"https:\/\/www.intego.com\/mac-security-blog\/mac-security-newsletter\/\"><strong>e-mail newsletter<\/strong><\/a> and keep an eye here on <a href=\"https:\/\/www.intego.com\/mac-security-blog\"><strong>The Mac Security Blog<\/strong><\/a> for the latest Apple security and privacy news. And don&#8217;t forget to follow Intego on your favorite social media channels: <a href=\"https:\/\/x.com\/IntegoSecurity\" target=\"_blank\" rel=\"noopener\"><img style=\"border-width: 1px; border-style: solid; border-color: rgba(255, 255, 255, 0.2); border-radius: 8px;\" title=\"Follow Intego on Twitter\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2021\/10\/Twitter-logo-icon-64.png\" alt=\"Follow Intego on Twitter\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/www.facebook.com\/Intego\" target=\"_blank\" rel=\"noopener\"><img style=\"border-width: 1px; border-style: solid; border-color: rgba(255, 255, 255, 0.2); border-radius: 8px;\" title=\"Follow Intego on Facebook\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2021\/10\/Facebook-logo-icon-64.png\" alt=\"Follow Intego on Facebook\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/www.youtube.com\/user\/IntegoVideo?sub_confirmation=1\" target=\"_blank\" rel=\"noopener\"><img style=\"border-width: 1px; border-style: solid; border-color: rgba(0, 0, 0, 0.2); border-radius: 8px;\" title=\"Follow Intego on YouTube\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2021\/10\/YouTube-logo-icon-64.png\" alt=\"Follow Intego on YouTube\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/www.pinterest.com\/intego\/\" target=\"_blank\" rel=\"noopener\"><img style=\"border-width: 1px; border-style: solid; border-color: rgba(0, 0, 0, 0.2); border-radius: 8px;\" title=\"Follow Intego on Pinterest\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2021\/10\/Pinterest-logo-icon-64.png\" alt=\"Follow Intego on Pinterest\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/www.linkedin.com\/company\/intego\" target=\"_blank\" rel=\"noopener\"><img style=\"border-width: 1px; border-style: solid; border-color: rgba(255, 255, 255, 0.2); border-radius: 8px;\" title=\"Follow Intego on LinkedIn\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2021\/10\/LinkedIn-logo-icon-64.png\" alt=\"Follow Intego on LinkedIn\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/www.instagram.com\/intego_security\/\" target=\"_blank\" rel=\"noopener\"><img style=\"border-width: 1px; border-style: solid; border-color: rgba(255, 255, 255, 0.2); border-radius: 8px;\" title=\"Follow Intego on Instagram\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2021\/10\/Instagram-logo-icon-64.png\" alt=\"Follow Intego on Instagram\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/podcasts.apple.com\/us\/podcast\/intego-mac-podcast\/id1293834627\" target=\"_blank\" rel=\"noopener\"><img style=\"border-width: 1px; border-style: solid; border-color: rgba(255, 255, 255, 0.2); border-radius: 8px;\" title=\"Follow the Intego Mac Podcast on Apple Podcasts\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2017\/10\/ios9-podcasts-app-tile.png\" alt=\"Follow the Intego Mac Podcast on Apple Podcasts\" width=\"16\" \/><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Mac malware campaigns from AtomicStealer, MetaStealer, and Realst have all been active in September. We break down the recent developments, including exclusive new insights into Realst recruiting efforts.<\/p>\n","protected":false},"author":14,"featured_media":97907,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false},"categories":[190],"tags":[4737,4615,86,4722],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v17.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<meta name=\"description\" content=\"Mac malware campaigns from AtomicStealer, MetaStealer, and Realst have all been active in September. We break down the recent developments, including exclusive new insights into Realst recruiting efforts.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.intego.com\/mac-security-blog\/mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Mac data-stealer malware roundup: AtomicStealer, MetaStealer, Realst all active in September - The Mac Security Blog\" \/>\n<meta property=\"og:description\" content=\"Mac malware campaigns from AtomicStealer, MetaStealer, and Realst have all been active in September. We break down the recent developments, including exclusive new insights into Realst recruiting efforts.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.intego.com\/mac-security-blog\/mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september\/\" \/>\n<meta property=\"og:site_name\" content=\"The Mac Security Blog\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/JoshLong\" \/>\n<meta property=\"article:published_time\" content=\"2023-09-22T22:28:13+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-08-09T02:11:19+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2023\/05\/cryptocurrency-and-cookie-stealing-malware-400x260-1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"400\" \/>\n\t<meta property=\"og:image:height\" content=\"260\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@theJoshMeister\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Joshua Long\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#organization\",\"name\":\"Intego\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/\",\"sameAs\":[],\"logo\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#logo\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png\",\"contentUrl\":\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png\",\"width\":875,\"height\":875,\"caption\":\"Intego\"},\"image\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#logo\"}},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#website\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/\",\"name\":\"The Mac Security Blog\",\"description\":\"Keep Macs safe from the dangers of the Internet\",\"publisher\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.intego.com\/mac-security-blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september\/#primaryimage\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2023\/05\/cryptocurrency-and-cookie-stealing-malware-400x260-1.jpg\",\"contentUrl\":\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2023\/05\/cryptocurrency-and-cookie-stealing-malware-400x260-1.jpg\",\"width\":400,\"height\":260,\"caption\":\"Cryptocurrency, cookie, password credential stealing macOS malware\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september\/#webpage\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september\/\",\"name\":\"Mac data-stealer malware roundup: AtomicStealer, MetaStealer, Realst all active in September - The Mac Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september\/#primaryimage\"},\"datePublished\":\"2023-09-22T22:28:13+00:00\",\"dateModified\":\"2024-08-09T02:11:19+00:00\",\"description\":\"Mac malware campaigns from AtomicStealer, MetaStealer, and Realst have all been active in September. We break down the recent developments, including exclusive new insights into Realst recruiting efforts.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.intego.com\/mac-security-blog\/mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.intego.com\/mac-security-blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Mac data-stealer malware roundup: AtomicStealer, MetaStealer, Realst all active in September\"}]},{\"@type\":\"Article\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september\/#webpage\"},\"author\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/dcf592275ba6edde8d20f1e60029c6b1\"},\"headline\":\"Mac data-stealer malware roundup: AtomicStealer, MetaStealer, Realst all active in September\",\"datePublished\":\"2023-09-22T22:28:13+00:00\",\"dateModified\":\"2024-08-09T02:11:19+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september\/#webpage\"},\"wordCount\":1459,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2023\/05\/cryptocurrency-and-cookie-stealing-malware-400x260-1.jpg\",\"keywords\":[\"Atomic Stealer\",\"Malvertising\",\"Malware\",\"Stealer Malware\"],\"articleSection\":[\"Malware\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.intego.com\/mac-security-blog\/mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september\/#respond\"]}]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/dcf592275ba6edde8d20f1e60029c6b1\",\"name\":\"Joshua Long\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#personlogo\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/5ad29f4111ce14911abaa98cbbcdea42?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/5ad29f4111ce14911abaa98cbbcdea42?s=96&d=mm&r=g\",\"caption\":\"Joshua Long\"},\"description\":\"Joshua Long (@theJoshMeister), formerly Intego\\u2019s Chief Security Analyst, is a renowned security researcher and writer, and an award-winning public speaker. Josh has a master\\u2019s degree in IT concentrating in Internet Security and has taken doctorate-level coursework in Information Security. Apple has publicly acknowledged Josh for discovering an Apple\\u00a0ID authentication vulnerability. Josh has conducted cybersecurity research for well over 25 years, which is often featured by major news outlets worldwide. Keep up with Josh via X\/Twitter, LinkedIn, Facebook, Instagram, YouTube, Patreon, Mastodon, the JoshMeister on Security, and more. \\u2014\",\"sameAs\":[\"https:\/\/security.thejoshmeister.com\",\"https:\/\/www.facebook.com\/JoshLong\",\"https:\/\/www.instagram.com\/thejoshmeister\/\",\"https:\/\/www.linkedin.com\/in\/thejoshmeister\",\"https:\/\/www.pinterest.com\/thejoshmeister\/\",\"https:\/\/twitter.com\/theJoshMeister\",\"https:\/\/www.youtube.com\/@theJoshMeister\"],\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/author\/joshlong\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"description":"Mac malware campaigns from AtomicStealer, MetaStealer, and Realst have all been active in September. We break down the recent developments, including exclusive new insights into Realst recruiting efforts.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.intego.com\/mac-security-blog\/mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september\/","og_locale":"en_US","og_type":"article","og_title":"Mac data-stealer malware roundup: AtomicStealer, MetaStealer, Realst all active in September - The Mac Security Blog","og_description":"Mac malware campaigns from AtomicStealer, MetaStealer, and Realst have all been active in September. We break down the recent developments, including exclusive new insights into Realst recruiting efforts.","og_url":"https:\/\/www.intego.com\/mac-security-blog\/mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september\/","og_site_name":"The Mac Security Blog","article_author":"https:\/\/www.facebook.com\/JoshLong","article_published_time":"2023-09-22T22:28:13+00:00","article_modified_time":"2024-08-09T02:11:19+00:00","og_image":[{"width":400,"height":260,"url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2023\/05\/cryptocurrency-and-cookie-stealing-malware-400x260-1.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_creator":"@theJoshMeister","twitter_misc":{"Written by":"Joshua Long","Est. reading time":"10 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Organization","@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization","name":"Intego","url":"https:\/\/www.intego.com\/mac-security-blog\/","sameAs":[],"logo":{"@type":"ImageObject","@id":"https:\/\/www.intego.com\/mac-security-blog\/#logo","inLanguage":"en-US","url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png","contentUrl":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png","width":875,"height":875,"caption":"Intego"},"image":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#logo"}},{"@type":"WebSite","@id":"https:\/\/www.intego.com\/mac-security-blog\/#website","url":"https:\/\/www.intego.com\/mac-security-blog\/","name":"The Mac Security Blog","description":"Keep Macs safe from the dangers of the Internet","publisher":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.intego.com\/mac-security-blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"ImageObject","@id":"https:\/\/www.intego.com\/mac-security-blog\/mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september\/#primaryimage","inLanguage":"en-US","url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2023\/05\/cryptocurrency-and-cookie-stealing-malware-400x260-1.jpg","contentUrl":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2023\/05\/cryptocurrency-and-cookie-stealing-malware-400x260-1.jpg","width":400,"height":260,"caption":"Cryptocurrency, cookie, password credential stealing macOS malware"},{"@type":"WebPage","@id":"https:\/\/www.intego.com\/mac-security-blog\/mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september\/#webpage","url":"https:\/\/www.intego.com\/mac-security-blog\/mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september\/","name":"Mac data-stealer malware roundup: AtomicStealer, MetaStealer, Realst all active in September - The Mac Security Blog","isPartOf":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september\/#primaryimage"},"datePublished":"2023-09-22T22:28:13+00:00","dateModified":"2024-08-09T02:11:19+00:00","description":"Mac malware campaigns from AtomicStealer, MetaStealer, and Realst have all been active in September. We break down the recent developments, including exclusive new insights into Realst recruiting efforts.","breadcrumb":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.intego.com\/mac-security-blog\/mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.intego.com\/mac-security-blog\/mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.intego.com\/mac-security-blog\/"},{"@type":"ListItem","position":2,"name":"Mac data-stealer malware roundup: AtomicStealer, MetaStealer, Realst all active in September"}]},{"@type":"Article","@id":"https:\/\/www.intego.com\/mac-security-blog\/mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september\/#article","isPartOf":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september\/#webpage"},"author":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/dcf592275ba6edde8d20f1e60029c6b1"},"headline":"Mac data-stealer malware roundup: AtomicStealer, MetaStealer, Realst all active in September","datePublished":"2023-09-22T22:28:13+00:00","dateModified":"2024-08-09T02:11:19+00:00","mainEntityOfPage":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september\/#webpage"},"wordCount":1459,"commentCount":0,"publisher":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization"},"image":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september\/#primaryimage"},"thumbnailUrl":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2023\/05\/cryptocurrency-and-cookie-stealing-malware-400x260-1.jpg","keywords":["Atomic Stealer","Malvertising","Malware","Stealer Malware"],"articleSection":["Malware"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.intego.com\/mac-security-blog\/mac-data-stealer-malware-roundup-atomicstealer-metastealer-realst-all-active-in-september\/#respond"]}]},{"@type":"Person","@id":"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/dcf592275ba6edde8d20f1e60029c6b1","name":"Joshua Long","image":{"@type":"ImageObject","@id":"https:\/\/www.intego.com\/mac-security-blog\/#personlogo","inLanguage":"en-US","url":"https:\/\/secure.gravatar.com\/avatar\/5ad29f4111ce14911abaa98cbbcdea42?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/5ad29f4111ce14911abaa98cbbcdea42?s=96&d=mm&r=g","caption":"Joshua Long"},"description":"Joshua Long (@theJoshMeister), formerly Intego\u2019s Chief Security Analyst, is a renowned security researcher and writer, and an award-winning public speaker. Josh has a master\u2019s degree in IT concentrating in Internet Security and has taken doctorate-level coursework in Information Security. Apple has publicly acknowledged Josh for discovering an Apple\u00a0ID authentication vulnerability. Josh has conducted cybersecurity research for well over 25 years, which is often featured by major news outlets worldwide. Keep up with Josh via X\/Twitter, LinkedIn, Facebook, Instagram, YouTube, Patreon, Mastodon, the JoshMeister on Security, and more. \u2014","sameAs":["https:\/\/security.thejoshmeister.com","https:\/\/www.facebook.com\/JoshLong","https:\/\/www.instagram.com\/thejoshmeister\/","https:\/\/www.linkedin.com\/in\/thejoshmeister","https:\/\/www.pinterest.com\/thejoshmeister\/","https:\/\/twitter.com\/theJoshMeister","https:\/\/www.youtube.com\/@theJoshMeister"],"url":"https:\/\/www.intego.com\/mac-security-blog\/author\/joshlong\/"}]}},"jetpack_featured_media_url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2023\/05\/cryptocurrency-and-cookie-stealing-malware-400x260-1.jpg","jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p4VAYd-pIO","amp_enabled":true,"_links":{"self":[{"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/98878"}],"collection":[{"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/users\/14"}],"replies":[{"embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/comments?post=98878"}],"version-history":[{"count":18,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/98878\/revisions"}],"predecessor-version":[{"id":101358,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/98878\/revisions\/101358"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/media\/97907"}],"wp:attachment":[{"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/media?parent=98878"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/categories?post=98878"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/tags?post=98878"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}