Go-Based macOS Infostealer Targets Crypto Wallets and Credentials — Detection and Response Guide | Security Arsenal

Security researchers have identified a new macOS malware variant written in Go that is actively stealing cryptocurrency wallet data, saved passwords, browser credentials, and other sensitive secrets from infected systems. This is not a proof-of-concept or a research curiosity — it is a functional, in-the-wild infostealer built with a language that gives attackers reliable cross-compilation, small operational footprints, and binaries that blend in with the growing volume of legitimate Go-based tooling enterprises now deploy.

For defenders, this campaign matters for three reasons. First, macOS is no longer a secondary target — infostealer development for Apple platforms has accelerated dramatically, and the days of treating Macs as "safe by default" endpoints are long over. Second, Go-compiled malware frustrates traditional signature-based detection: the binaries are large, statically linked, often unsigned or ad-hoc signed, and share little code overlap with prior samples, so hash-based blocklists age out within days. Third, the target data — seed phrases, private keys, keychain entries, session cookies — means a single compromised Mac can translate directly into drained wallets and hijacked SaaS sessions within hours, not weeks.

If your organization allows Macs for developers, executives, or finance staff (and crypto-adjacent staff especially), treat this as an active threat requiring hunting today, not awareness training someday.

Technical Analysis

What the Malware Does

Based on the reported behavior, the malware follows the now-standard macOS infostealer playbook, implemented in Go:

Delivery and execution. Go-based macOS stealers in this family are typically distributed as trojanized applications, cracked software, fake updates, or malicious disk images (.dmg). Because Go binaries compile to self-contained executables, the payload runs without dependencies and can target both Intel (amd64) and Apple Silicon (arm64) — often shipped as universal binaries. Gatekeeper bypass is commonly achieved by socially engineering the user into right-click-opening an unsigned app or by abusing ad-hoc signatures.
Credential and secrets theft. The stealer enumerates and exfiltrates:
- Browser data from Chrome, Firefox, Edge, Brave, and Safari — cookies, saved logins, autofill data, and browser-stored crypto wallet extensions (MetaMask, Phantom, and similar) under ~/Library/Application Support/
- The macOS Keychain (~/Library/Keychains/login.keychain-db), frequently preceded by a spoofed osascript dialog prompting the user for their password so the malware can decrypt keychain contents
- Desktop cryptocurrency wallet data directories for wallets such as Exodus, Electrum, Atomic, and Ledger Live
- Files on the Desktop and in Documents matching patterns for seed phrases, private keys, and password files (e.g., files containing "seed", "mnemonic", "private key", "wallet")
- System information, SSH keys (~/.ssh/), and session tokens for Telegram, Discord, and VPN clients
Staging and exfiltration. Collected data is staged in a temporary directory (commonly under /tmp/ or /var/tmp/ or a hidden folder in the user's home directory), archived (zip/tar), and exfiltrated over HTTPS to attacker-controlled infrastructure — frequently using curl, Go's native HTTP client, or hardcoded C2 endpoints including Telegram bot APIs and paste-style dead-drop services.

Why Go Makes This Harder to Catch

From a detection engineering perspective, Go malware on macOS presents specific challenges:

Static linking and size: Go binaries are typically 5–15 MB even for simple stealers, which defeats some naive file-size heuristics but is itself a signal — a 12 MB unsigned "utility" executing from /tmp is suspicious on its face.
No interpreter artifacts: Unlike Python or AppleScript stealers, there is no script content to inspect on disk; detection must lean on behavior — what the process touches, not what it is.
Signed-adjacent execution: Attackers increasingly distribute these payloads inside legitimate-looking app bundles with ad-hoc or stolen developer signatures, so code-signing state must be evaluated, not assumed.
Cross-platform reuse: The same codebase compiles for Windows and Linux, so the C2 infrastructure and exfiltration patterns you identify here will likely overlap with campaigns hitting your other platforms.

Behavioral Attack Chain (MITRE ATT&CK Mapping)

Stage	Technique	Observable Behavior
Execution	T1204.002 – Malicious File	User launches unsigned/ad-hoc-signed binary from Downloads or /tmp
Credential Access	T1555.001 – Keychain	Process reads `~/Library/Keychains/login.keychain-db`
Credential Access	T1539 – Steal Web Session Cookie	Bulk read of browser `Cookies` / `Login Data` SQLite stores
Credential Access	T1552.001 – Credentials In Files	Recursive file search for seed phrases, keys, wallet files
Collection	T1560.001 – Archive via Utility	zip/tar archive created in /tmp or hidden staging dir
Exfiltration	T1041 – Exfil Over C2 Channel	HTTPS POST of archive to rare/external host

Exploitation Status

This is confirmed active in-the-wild malware, not a theoretical capability. No CVE is associated with this campaign — it relies on social engineering and user execution rather than a software vulnerability, which means patching alone cannot close the door. There is no CISA KEV entry because no product vulnerability is exploited. Your mitigation surface is execution control, behavioral detection, and secrets hygiene.

Detection & Response

The detections below focus on durable behaviors — keychain access by non-system processes, browser credential store reads, mass secret-file enumeration, and archive-and-exfil staging — rather than file hashes that will be obsolete by the time you deploy them.

YAML

---
title: macOS Suspicious Process Reading Keychain Database
id: 3f8c2a71-9b4d-4e6a-b1c5-7d8e9f0a1b2c
status: experimental
description: Detects non-system processes accessing the macOS login keychain database, a hallmark of infostealer credential theft such as Go-based macOS stealers targeting keychain secrets.
references:
  - https://attack.mitre.org/techniques/T1555/001/
  - https://www.infosecurity-magazine.com/news/gobased-macos-malware-crypto-and/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.credential_access
  - attack.t1555.001
logsource:
  category: file_event
  product: macos
detection:
  selection_path:
    TargetFilename|contains:
      - '/Library/Keychains/login.keychain-db'
      - '/Library/Keychains/'
  filter_legitimate:
    Image|endswith:
      - '/securityd'
      - '/Keychain Access.app/Contents/MacOS/Keychain Access'
      - '/usr/sbin/security'
      - '/usr/bin/security'
      - '/1Password'
  condition: selection_path and not filter_legitimate
falsepositives:
  - Legitimate password managers (1Password, Bitwarden) reading keychain during migration
  - Enterprise MDM agents performing keychain operations
level: high
---
title: macOS Browser Credential Store Access by Unsigned Process
id: 5a1d3e92-4c7b-4f8a-a2d6-1e9f0b2c3d4e
status: experimental
description: Detects processes reading browser credential and cookie databases (Chrome, Firefox, Brave, Edge) outside the browser itself — consistent with infostealer session and password theft on macOS.
references:
  - https://attack.mitre.org/techniques/T1539/
  - https://attack.mitre.org/techniques/T1555/003/
  - https://www.infosecurity-magazine.com/news/gobased-macos-malware-crypto-and/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.credential_access
  - attack.t1539
  - attack.t1555.003
logsource:
  category: file_event
  product: macos
detection:
  selection:
    TargetFilename|contains:
      - '/Library/Application Support/Google/Chrome/Default/Cookies'
      - '/Library/Application Support/Google/Chrome/Default/Login Data'
      - '/Library/Application Support/BraveSoftware/Brave-Browser/Default/Cookies'
      - '/Library/Application Support/Microsoft Edge/Default/Cookies'
      - '/Library/Application Support/Firefox/Profiles/'
      - '/Library/Containers/com.apple.Safari/Data/Library/Cookies/'
  filter_browsers:
    Image|contains:
      - '/Google Chrome.app/'
      - '/Brave Browser.app/'
      - '/Microsoft Edge.app/'
      - '/Firefox.app/'
      - '/Safari.app/'
  condition: selection and not filter_browsers
falsepositives:
  - EDR/DFIR tooling performing legitimate collection
  - Backup agents with full-disk access
level: high
---
title: macOS Archive Creation in Temp Followed by Curl Exfiltration
id: 8b2e4f13-6d9a-4b5c-c3e7-2f0a1b3c4d5e
status: experimental
description: Detects archive utilities or curl executing from temporary or user-writable paths, a common staging-and-exfiltration pattern used by macOS infostealers packaging stolen secrets for HTTPS upload.
references:
  - https://attack.mitre.org/techniques/T1560/001/
  - https://attack.mitre.org/techniques/T1041/
  - https://www.infosecurity-magazine.com/news/gobased-macos-malware-crypto-and/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.collection
  - attack.exfiltration
  - attack.t1560.001
  - attack.t1041
logsource:
  category: process_creation
  product: macos
detection:
  selection_archive:
    Image|endswith:
      - '/zip'
      - '/tar'
      - '/ditto'
    CommandLine|contains:
      - '/tmp/'
      - '/var/tmp/'
      - '$TMPDIR'
  selection_exfil:
    Image|endswith: '/curl'
    CommandLine|contains:
      - '-F '
      - '--form'
      - '-T '
      - '--upload-file'
      - '-d @'
      - 'api.telegram.org'
      - 'discord.com/api/webhooks'
  condition: 1 of selection_*
falsepositives:
  - Developer build scripts archiving artifacts to /tmp
  - Legitimate curl usage in CI/CD or admin scripts — baseline by host role
level: medium

KQL — Microsoft Sentinel / Defender

// Hunt: macOS infostealer behavior — keychain/browser store access, temp staging, exfil
// Requires Microsoft Defender for Endpoint on macOS (DeviceProcessEvents / DeviceFileEvents / DeviceNetworkEvents)

// 1) Non-browser processes touching browser credential stores or Keychain
let SensitivePaths = dynamic([
  "/Library/Keychains/login.keychain-db",
  "Application Support/Google/Chrome/Default/Cookies",
  "Application Support/Google/Chrome/Default/Login Data",
  "BraveSoftware/Brave-Browser/Default/Cookies",
  "Microsoft Edge/Default/Cookies",
  "Application Support/Firefox/Profiles"
]);
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where SensitivePaths has_any (FolderPath)
| extend ProcessName = tostring(split(InitiatingProcessFileName, "/")[-1])
| where ProcessName !in~ ("Google Chrome", "Brave Browser", "Microsoft Edge", "firefox", "securityd", "security")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, ActionType
| order by TimeGenerated desc;

// 2) Unsigned/unknown binaries executing from user-writable or temp locations
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any ("/tmp/", "/var/tmp/", "/Users/Shared/", "Downloads")
| where FileName !in~ ("curl", "git", "node", "python3")  // tune per environment
| join kind=leftouter (
    DeviceFileCertificateInfo
    | project SHA1, IsTrusted, Signer
  ) on SHA1
| where IsTrusted != 1 or isempty(IsTrusted)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Commands=make_set(ProcessCommandLine, 10)
  by DeviceName, FolderPath, FileName, SHA1, Signer
| order by FirstSeen desc;

// 3) Outbound transfer shortly after archive creation (exfil correlation)
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("curl", "wget") or RemoteUrl has_any ("api.telegram.org", "discord.com/api/webhooks", "pastebin.com")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| order by TimeGenerated desc

VQL — Velociraptor

-- Velociraptor hunt: macOS infostealer artifacts
-- Identify suspicious unsigned processes, staging archives, and secret-file access

-- 1) Running processes executing from temp / user-writable paths (typical stealer drop locations)
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ '^/(tmp|var/tmp|Users/Shared|private/tmp)/'
   OR CommandLine =~ '/tmp/.*(zip|tar|curl)'

-- 2) Recently created archives in staging locations (last 72 hours)
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=['/tmp/*.zip', '/tmp/*.tar*', '/var/tmp/*.zip', '/var/tmp/*.tar*', '/Users/*/.*/*.zip'])
WHERE Mtime > (now() - 259200)

-- 3) Network connections from non-standard processes (spot exfil channels)
SELECT Pid, Name, Path, RemoteAddr, RemotePort, State
FROM netstat()
WHERE State =~ 'ESTABLISHED'
  AND RemotePort in (443, 8443)
  AND Path !~ '(Safari|Chrome|Firefox|Brave|Edge|cloudd|apsd|softwareupdated)'

Bash / Shell

#!/usr/bin/env bash
# macOS Infostealer Triage & Hardening Script
# Run with sudo on suspected hosts. Collects evidence, checks persistence,
# and applies hardening. Test in a lab before fleet-wide deployment.

set -euo pipefail
OUT="/var/tmp/macos_stealer_triage_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$OUT"
echo "[+] Output directory: $OUT"

# ---------- 1) EVIDENCE: Processes running from suspicious paths ----------
echo "[+] Enumerating processes executing from temp/user-writable paths..."
ps auxww | grep -Ei '/tmp/|/var/tmp/|/private/tmp/|/Users/Shared/' \
  | grep -v grep > "$OUT/suspicious_processes.txt" || true

# ---------- 2) EVIDENCE: Recent archives in staging locations ----------
echo "[+] Hunting staged archives (last 3 days)..."
find /tmp /var/tmp /private/tmp -maxdepth 3 \
  \( -name '*.zip' -o -name '*.tar*' -o -name '*.7z' \) \
  -mtime -3 -ls > "$OUT/staging_archives.txt" 2>/dev/null || true

# ---------- 3) EVIDENCE: Unsigned/ad-hoc binaries in user dirs ----------
echo "[+] Checking code-signing state of executables in Downloads..."
while IFS= read -r f; do
  sig=$(codesign -dv "$f" 2>&1 | head -2 || echo "UNSIGNED")
  echo "$f :: $sig" >> "$OUT/codesign_audit.txt"
done < <(find /Users/*/Downloads -type f -perm +111 -mtime -14 2>/dev/null || true)

# ---------- 4) EVIDENCE: Persistence mechanisms ----------
echo "[+] Dumping LaunchAgents/LaunchDaemons..."
ls -la /Library/LaunchAgents /Library/LaunchDaemons \
  ~/Library/LaunchAgents 2>/dev/null > "$OUT/persistence_listing.txt" || true
# Flag plists modified in the last 14 days
find /Library/LaunchAgents /Library/LaunchDaemons \
  ~/Library/LaunchAgents -name '*.plist' -mtime -14 \
  -ls >> "$OUT/recent_persistence.txt" 2>/dev/null || true

# ---------- 5) EVIDENCE: Active exfil channels ----------
echo "[+] Capturing established outbound connections by process..."
lsof -iTCP -sTCP:ESTABLISHED -nP > "$OUT/network_connections.txt" || true

# ---------- 6) CONTAINMENT (uncomment after review) ----------
# Kill processes executing from temp paths
# for pid in $(ps auxww | awk '/\/tmp\/|\/var\/tmp\// && !/awk/ {print $2}'); do
#   echo "[!] Killing suspicious PID $pid"; kill -9 "$pid" 2>/dev/null || true
# done

# ---------- 7) HARDENING ----------
echo "[+] Verifying Gatekeeper and XProtect state..."
spctl --status | tee "$OUT/gatekeeper_status.txt"
/usr/libexec/PlistBuddy -c "Print :LastSuccessfulXProtectUpdate" \
  /Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Info.plist \
  >> "$OUT/gatekeeper_status.txt" 2>/dev/null || true

# Enforce Gatekeeper (safe to apply fleet-wide)
echo "[+] Enforcing Gatekeeper..."
spctl --master-enable

# ---------- 8) FILEVAULT check (protects stolen-disk/keychain exposure) ----------
fdesetup status | tee "$OUT/filevault_status.txt"

echo "[+] Triage complete. Review artifacts in $OUT"
echo "[!] If keychain/browser store access by unknown processes is confirmed:"
echo "    - Isolate host from network"
echo "    - Rotate ALL credentials reachable from this user (browsers, SaaS, SSH, API keys)"
echo "    - Move crypto assets to fresh wallets with new seed phrases from a CLEAN device"

Remediation and Hardening

Because this campaign exploits user trust rather than a software flaw, remediation is layered — there is no single patch to deploy.

Immediate Response (Suspected Infection)

Isolate the host from the network immediately. Infostealers exfiltrate in minutes; every connected hour is more secrets gone.
Assume all reachable credentials are compromised. Rotate every password stored in the user's browsers and keychain, every SaaS session (revoke tokens, don't just change passwords), SSH keys in ~/.ssh/, cloud CLI credentials (~/.aws, ~/.config/gcloud), and API tokens.
Treat crypto wallets as burned. Seed phrases and private keys on an infected host must be considered public. Generate new wallets from a known-clean device and transfer assets — do this before attackers sweep them, which is typically automated and near-instant.
Preserve evidence before reimaging. Collect the triage artifacts from the script above, memory if feasible, and the original binary for sandbox analysis and IOC extraction (C2 domains feed your blocklists and retro-hunts).
Hunt fleet-wide using the KQL and VQL queries above — infostealers rarely hit a single host, and the same delivery lure was likely sent to multiple users.

Preventive Hardening

Enforce Gatekeeper and notarization. Use MDM to block execution of unsigned and ad-hoc-signed binaries where your application inventory allows it. At minimum, alert on any unsigned binary executing from /tmp, /var/tmp, /Users/Shared, or Downloads.
Deploy an EDR that covers macOS properly. Microsoft Defender for Endpoint, CrowdStrike, Jamf Protect, and SentinelOne all have macOS sensors — but many organizations deploy them on Windows only. This campaign is a good forcing function to close that gap.
Block known exfil channels at the egress layer. Telegram Bot API endpoints (api.telegram.org), Discord webhooks, and paste sites have near-zero legitimate use from most corporate Macs. Alert on or block them.
Move secrets out of browsers and off disk. Enforce a dedicated password manager instead of browser-saved credentials, use hardware-backed FIDO2 for SaaS sessions (stolen cookies bypass passwords but hardware-bound passkeys raise the bar), and prohibit seed phrases or private keys stored as plaintext files. Use MDM compliance policies to detect their presence.
Restrict osascript abuse. Several macOS EDR/MDM stacks can alert on osascript spawning password-prompt dialogs (display dialog ... with hidden answer) — the classic trick stealers use to phish the local password for keychain decryption.
Keep macOS and XProtect current. Apple ships rapid security responses and silent XProtect signature updates; verify with the script above that XProtect is updating on schedule.

Detection Engineering Notes

Tune the Sigma and KQL rules against your developer population first — engineers legitimately run binaries from /tmp and script with curl, so baseline by role and filter known CI/build tooling before enabling at high severity. The keychain-access rule (first Sigma rule) is the highest-fidelity signal of the three and should be safe to enable broadly once password-manager processes are allow-listed.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub

Go-Based macOS Infostealer Targets Crypto Wallets and Credentials — Detection and Response Guide