The tug-of-war between hackers and Apple continues at pace
Hackers are developing infostealing malware for macOS at such pace that Apple can’t keep up. As a result, multiple variants frequently move past macOS’ anti-malware system, XProtect, and steal sensitive data from compromised endpoints.
This is according to a new report from cybersecurity researchers SentinelOne, which gave three examples: KeySteal, Atomic Stealer, and CherryPie. KeySteal is an infostealing malware first spotted in 2021, which has evolved significantly since then. It is designed to steal information from Keychain, macOS’ native password manager where users can store credentials, private keys, notes, and more.
Last time Apple updated its signature for KeySteal was roughly a year ago, in February 2023, but the malware has undergone such a dramatic change since then that XProtect no longer detects it.
