MioLab MacOS Stealer Expands With ClickFix, Wallet Theft, Team APIs

MioLab (aka Nova) is a professionally marketed macOS infostealer offered as Malware‑as‑a‑Service that targets browsers, Keychain, Apple Notes, messaging apps, and over 200 crypto wallet extensions as well as desktop wallets and hardware‑wallet companion apps to harvest credentials and exfiltrate data; it uses obfuscation, social‑engineering ClickFix delivery, and a polished web panel with proxy and builder infrastructure to scale theft and evade takedowns. The report outlines attack chain, technical capabilities, infrastructure reuse (including Cloudflare‑fronted domains and bulletproof hosting), and practical mitigations such as hardening Terminal policies, detecting abuse of dscl/osascript/system_profiler/curl, blocking known C2 ranges, enforcing code signing, and user education.