“Say My Name”: How MioLab is building MacOS Stealer Empire
Source AlienVault OTX General
Description
MioLab, also known as Nova, is a sophisticated Malware-as-a-Service platform targeting macOS environments, heavily advertised on Russian-speaking underground forums. The platform features extensive data exfiltration capabilities, including browser credential theft, cryptocurrency wallet targeting (supporting over 200 browser extensions and 50+ desktop wallets), and a premium module specifically designed to compromise Ledger and Trezor hardware wallets by intercepting 24-word BIP39 recovery seed phrases. The lightweight C-based payload supports both Intel and Apple Silicon architectures across macOS versions from Sierra to Tahoe. MioLab employs sophisticated social engineering through customizable DMG builders with live preview features, fake system prompts, and ClickFix integration. Recent updates demonstrate rapid development, including Safari cookie grabbing, automated Apple Notes decryption, and universal hardware wallet modules. The operation utilizes bulletproof hosting services and shares infrastruct...
Indicators of compromise
Domains 64
- http.host
- marinemember.com
- officerelaxation.com
- approve-me.com
- decodecybercrime.com
- mioisiskwowiwjowuwjwolab.club
- zynce.org
- playavalon.org
- socifiapp.com
- command-confirm.com
URLs 5
- https://socifiapp.com/api/reports/upload
- http://mioisiskwowiwjowuwjwolab.club/login
- https://bruceketta.space/posts/nova-script-251110/
- https://decodecybercrime.com/mapping-defhost-an-investigation-into-femo-it-solutions-limited-as214351/
- https://socifiapp.com