MacStealer is a macOS stealer Uptycs found for sale on the dark web in March 2023, controlled through Telegram, that spreads as a disk image and shows a fake 'MacOS wants to access the System Preferences' password prompt. If you typed your password into a prompt like that from a new app, delete the app and change your Mac, Keychain and browser passwords from another device.
Last reviewed · 1 source
Also known as: MacStealer, OSX.MacStealer
Uptycs found MacStealer advertised on the dark web in March 2023, sold as builds (the seller asked $100 per build). It runs on macOS Catalina and later, on Intel and Apple M1 and M2 Macs, spreads as a .dmg, and phishes your password with a fake System Preferences dialog shown through osascript. It takes documents, browser cookies and logins, and the Keychain database, zips them and sends them to its command server, which forwards them to the operator's Telegram bot.
Builds sold on the dark web to criminals who spread them
Disk images (.dmg) passed to victims, such as one named weed.dmg (Uptycs)
A fake password dialog shown as soon as the app opens
A dialog titled System Preferences asking for your password right after opening a downloaded app
Browser saved passwords or autofill data missing or changed
Account sign-in alerts you don't recognize after installing something new
Turn off Wi-Fi or unplug Ethernet so nothing more is sent while you clean up.
Quit the app that showed the fake prompt (use Force Quit in Activity Monitor if needed), then delete it from /Applications and ~/Downloads, along with the .dmg it came in.
Look in ~/Library/LaunchAgents and System Settings › General › Login Items & Extensions for anything added at the same time.
If you typed your password into the fake dialog, change your Mac password, then change browser-saved passwords and any crypto wallet credentials from another device.
CoreLock's free scan compares files in your Downloads folder against a built-in malware-hash list and 19 YARA rules. It can't promise to find every leftover file.
Never type your Mac password into a dialog that appears right after opening a new app
On macOS 13 and later the app is called System Settings, so a prompt that names 'System Preferences' is a giveaway
Avoid apps passed around through Telegram channels and messaging groups
Get apps from the Mac App Store or the developer's own site
What it can and can't do
MacStealer comes as a disk image, so the relevant check is CoreLock's free Downloads check, which compares files against a built-in malware-hash list and 19 YARA rules and shows a match as worth a look without quarantining it. It can't promise to catch every build.
Stealer — Atomic Stealer (AMOS) is a macOS information stealer that Cyble found advertised...
Stealer — Realst is a macOS information stealer written in Rust. Security researcher iamde...
Stealer — Banshee Stealer appeared in mid-2024 and was rented out for $3,000 a month throu...
System Settings › Privacy & Security › Screen & System Audio Recording (called Screen Recording on macOS 13)
System Settings › Privacy & Security › Full Disk Access
System Settings › Privacy & Security › Accessibility (on macOS 27, some developers' guides call this pane Device Control and Data Access)
A macOS stealer Uptycs found in March 2023 that uses Telegram for command and control. It phishes your password with a fake dialog, then takes documents, browser cookies and logins, and the Keychain database.
It uses osascript, the built-in tool for running AppleScript, to show a dialog titled 'System Preferences' that says 'MacOS wants to access the System Preferences' and asks for your password.
Be suspicious of any password prompt that appears the moment a newly downloaded app opens. On macOS 13 and later the settings app is called System Settings, so a prompt that says System Preferences is fake. When in doubt, click Cancel and open System Settings yourself.
Free, with no account: the scan checks your Downloads folder against a built-in malware-hash list and 19 YARA rules.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser