NovaStealer · Apple Intelligence is leaving a plist.. it is legit, right?
Source AlienVault OTX General
Description
NovaStealer is a macOS-targeting cryptostealer malware that uses bash scripts to establish persistence and execute malicious modules. It installs itself in the ~/. mdrivers directory, uses screen sessions for stealthy background execution, and employs LaunchAgents to maintain persistence. The malware exfiltrates cryptocurrency wallet data, collects system information, and replaces legitimate wallet applications with malicious versions. It also uses WebKit to render phishing pages and tracks user behavior to increase effectiveness. While not highly sophisticated, its modular design allows remote updates, making it adaptable and persistent. The malware does not require prior authentication but relies on user interaction for initial infection, such as phishing. There are no known exploits in the wild yet, but the threat is notable due to its focus on valuable crypto assets on macOS systems.