Ankura CTIX FLASH Update - January 10, 2025

Malware Activity

Banshee Stealer Resurfaces with Enhanced Stealth, Targeting MacOS

Banshee Stealer, a macOS-focused information-stealing malware, has resurfaced since its source code was leaked in late 2024. Banshee was first discovered in August 2024 under a malware-as-a-service (MaaS) model, being sold to cybercriminals for $3,000 a month for its data harvesting capabilities. Banshee is built to steal data from web browsers, cryptocurrency wallets, and system files. The latest variant of the malware introduces a new encryption method modeled on Apple's XProtect built-in anti-malware tool. The advanced encryption allows the new Banshee variant to bypass antivirus systems and evade detection by blending in with normal operations. It is also notable that the variant removed a Russian language check criteria from its infection chain which previously prevented the malware from executing on hosts where Russian was set as the default system language. Banshee is being