Banshee: The Stealer That “Stole Code” From MacOS XProtect

Banshee macOS Stealer: Check Point Research analyzed a newly updated macOS infostealer (Banshee) that evaded detection for months by using XProtect-like string encryption and anti-analysis techniques (forking/daemonization). The actor distributed the stealer via malicious GitHub repositories and phishing sites, ran stealer-as-a-service campaigns (including dual OS campaigns alongside Lumma for Windows), exposed C2 infrastructure and campaign IDs, and the report includes technical details, YARA rules, IOCs, and mitigations.