Realst is a macOS stealer written in Rust, found in 2023 inside fake blockchain games that were promoted through websites, X (Twitter) and Discord accounts and direct messages. If you installed a game client from a link someone sent you, delete it, then change your browser and Keychain passwords and move any crypto to a new wallet from a device you trust.
Last reviewed · 1 source
Also known as: Realst Stealer, Realst Infostealer
Realst is a macOS information stealer written in Rust. Security researcher iamdeadlyz first reported the campaign, and SentinelOne found it spread through fake blockchain games such as Brawl Earth, WildWorld, Dawnland, Destruction, Evolion, Pearl, Olymp of Reptiles and SaintLegend, each with its own website and Twitter and Discord accounts. It steals browser data from Firefox, Chrome, Opera, Brave and Vivaldi, crypto wallets and the Keychain, using a copy of the open-source chainbreaker tool with the password it tricks you into typing. SentinelOne found samples already aimed at macOS 14 Sonoma before Sonoma's public release.
Fake blockchain and play-to-earn game websites with matching social media accounts
Direct messages on X (Twitter) and Discord inviting you to try a 'new game'
Game installers (PKG or DMG) that carry the stealer
A password prompt during setup that captures your Mac password
You installed a blockchain game from a link shared on social media
The game's installer asked for your Mac password
Saved browser passwords or crypto wallet balances changed unexpectedly
The 'game' never really worked after installing
Turn off Wi-Fi or unplug Ethernet so nothing more is sent while you clean up.
Remove the game app from /Applications and ~/Downloads, and check ~/Library/Application Support for a folder with the same name. Empty the Trash afterwards.
Look in ~/Library/LaunchAgents and System Settings › General › Login Items & Extensions for anything added when you installed the game, and remove what you don't recognize.
From another device, change the passwords stored in your browsers and Keychain, move crypto to new wallets, and sign out active sessions on exchanges.
CoreLock's free scan checks startup items and compares files in your Downloads folder against a built-in malware-hash list and 19 YARA rules. It shows what matched for you to review and can't promise to find every leftover file.
Don't install games or apps promoted through unsolicited direct messages
Check a game studio through independent sources before installing its client
Keep significant crypto holdings in a hardware wallet
Treat any installer that asks for your Mac password with suspicion
What it can and can't do
Realst arrives as a game installer you download yourself, so the check that matters is CoreLock's free Downloads check, which compares files against a built-in malware-hash list and 19 YARA rules and shows a match as worth a look without quarantining it. It can't promise to recognize every Realst build.
Stealer — Atomic Stealer (AMOS) is a macOS information stealer that Cyble found advertised...
Stealer — Uptycs found MacStealer advertised on the dark web in March 2023, sold as builds...
Stealer — Banshee Stealer appeared in mid-2024 and was rented out for $3,000 a month throu...
System Settings › Privacy & Security › Full Disk Access
System Settings › Privacy & Security › Accessibility (on macOS 27, some developers' guides call this pane Device Control and Data Access)
System Settings › Privacy & Security › Input Monitoring
Realst is a macOS stealer written in Rust that spreads through fake blockchain games. SentinelOne found it takes browser data, crypto wallets and Keychain passwords, and that the campaign approached people through direct messages on social media.
Through fake play-to-earn game websites. Each fake game had its own site and Twitter and Discord accounts, and the people behind it messaged potential victims directly, inviting them to download the game client.
That was its purpose: SentinelOne says the fake games were used to empty crypto wallets and steal stored passwords and browser data. Keep significant holdings in a hardware wallet, and never type your Mac password into a game's installer.
Free, with no account: the scan checks your Downloads folder against a built-in malware-hash list and 19 YARA rules.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser