By 
A new information stealer malware named 'MetaStealer' was found stealing a wide variety of sensitive information from Intel-based macOS computers.
MetaStealer is a Go-based malware capable of evading Apple's built-in antivirus tech XProtect, targeting business users.
SentinelOne reports it has been tracking the malware for the past couple of months, seeing an unusual involvement of social engineering in its distribution.
Although the malware has some similarities with Atomic Stealer, another Go-based macOS targeting info-stealer, the code overlap is limited, and the delivery methods are different. So, MetaStealer is a separate operation.
SentinelOne found a malware sample on VirusTotal with a comment stating the MetaStealer threat actors are contacting businesses and impersonating the company's clients to distribute the malware.
In these attacks, MetaStealer is distributed in the form of rogue application bundles in the disk image format (DMG), with targets approached through threat actors posing as prospective design clients in order to share a password-protected ZIP archive containing the DMG file.
Other instances have involved the malware masquerading as Adobe files or installers for Adobe Photoshop.
This specific targeting of business users is unusual for macOS malware, which is more commonly found being distributed via torrent sites or suspicious third-party software distributors as cracked versions of business, productivity or other popular software.
The main component of the payload is an obfuscated Go-based executable that comes with features to harvest data from iCloud Keychain, saved passwords, and files from the compromised host. All the samples observed so far are designed for Intel-based macOS machines.
Select versions of the malware have been observed containing functions that likely target Telegram and Meta services.
In its current version, MetaStealer only runs on Intel x86_64 architecture, so it cannot compromise macOS systems running on Apple Silicon processors (M1, M2) unless the victim uses Rosetta to run the malware.
This mitigates the threat and limits it to an ever-reducing number of potential victims as Intel-based Apple computers are being phased out.
However, MetaStealer might release a new version that adds native support for Apple Silicon, so it's a threat to watch out for.
