Banshee Stealer is a macOS stealer first sold in 2024 for $3,000 a month that reaches Macs through phishing sites and malicious GitHub repositories, then phishes your password to get at the Keychain. If an app from one of those sources asked for your password, delete it and change the passwords stored in your browsers and Keychain from another device.
Last reviewed · 2 sources
Also known as: Banshee, BansheeInfoStealer
Banshee Stealer appeared in mid-2024 and was rented out for $3,000 a month through Telegram and the XSS and Exploit forums (Check Point Research, Elastic Security Labs). It collects system information, data from a wide range of browsers and about 100 browser extensions, crypto wallets and Keychain passwords, after phishing your Mac password with a fake prompt. Check Point found a later build that encrypts its strings with the same algorithm Apple's XProtect uses, which kept it undetected for over two months until the original source code leaked on November 23, 2024; the author shut the service down the next day, but the malware kept spreading through phishing sites.
Phishing websites that imitate legitimate software download pages
Malicious GitHub repositories, some serving Lumma Stealer to Windows users and Banshee to Mac users (Check Point)
A fake password prompt that captures your Mac password
Copies built from the leaked source code by other criminals
A password prompt after installing software from a GitHub repository or download page
Browser data or crypto wallet balances changed unexpectedly
Keychain access prompts you didn't start
An app that did nothing useful after asking for your password
Turn off Wi-Fi or unplug Ethernet so nothing more is sent while you clean up.
Delete the app you installed and its installer, and check ~/Library/Application Support for a folder with the same name.
Look in ~/Library/LaunchAgents and System Settings › General › Login Items & Extensions for anything added at the same time.
From another device, change the passwords stored in your browsers and Keychain, and move crypto to new wallets created on a device you trust.
CoreLock's free scan checks startup items and compares files in your Downloads folder against a built-in malware-hash list and 19 YARA rules. It can't promise to find every leftover file.
Check a GitHub repository's history and maintainers before running anything from it
Don't override Gatekeeper warnings for apps from unknown developers
Keep passwords in a password manager rather than only in the browser
Treat any app that asks for your Mac password the moment it opens as suspect
What it can and can't do
Banshee is usually something you download, so CoreLock's free Downloads check, which compares files against a built-in malware-hash list and 19 YARA rules, is the relevant one, alongside the startup-items check. A match is shown as worth a look and never quarantined on its own, and CoreLock can't promise to catch every build.
Stealer — Atomic Stealer (AMOS) is a macOS information stealer that Cyble found advertised...
Stealer — Realst is a macOS information stealer written in Rust. Security researcher iamde...
Stealer — Uptycs found MacStealer advertised on the dark web in March 2023, sold as builds...
Check Point found a version that hides its strings with the same encryption algorithm Apple's XProtect uses for its own rules, which helped it go undetected for over two months. XProtect 5368 (macOS 26.5, checked October 29, 2026) now includes rules named for Banshee.
Elastic Security Labs lists system information, browser data from a wide range of browsers, about 100 browser extensions, crypto wallets, files, and Keychain passwords, which it unlocks with the password it phishes from you.
It was sold as a service for $3,000 a month. After its source code leaked on November 23, 2024, the author shut the operation down the next day, but Check Point saw the newer version still spreading through phishing websites.
Free, with no account: the scan checks your Downloads folder against a built-in malware-hash list and 19 YARA rules.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser