We rank vendors based on rigorous testing and research, but also take into account your feedback and our commercial agreements with providers. This page contains affiliate links.
Disclosure:
Professional Reviews

vpnMentor contains reviews that are written by our community reviewers. These take into consideration the reviewers’ independent and professional examination of the products/services.

Ownership

vpnMentor was established in 2014 as an independent site reviewing VPN services and covering privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: ExpressVPN, CyberGhost, ZenMate, Private Internet Access, and Intego, which may be reviewed on this website.

Affiliate Commissions Advertising

vpnMentor contains reviews that follow the strict reviewing standards, including ethical standards, that we have adopted. Such standards require that each review will take into consideration the independent, honest and professional examination of the reviewer. That being said, we may earn a commission when a user completes an action using our links, at no additional cost to them. On listicle pages, we rank vendors based on a system that prioritizes the reviewer’s examination of each service, but also considers feedback received from our readers and our commercial agreements with providers.

Reviews Guidelines

The reviews published on vpnMentor are written by community reviewers that examine the products according to our strict reviewing standards. Such standards ensure that each review prioritizes the independent, professional and honest examination of the reviewer, and takes into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings we publish may also take into consideration the affiliate commissions we earn for purchases through links on our website.

New MetaStealer Malware Targets macOS Users

New MetaStealer Malware Targets macOS Users
Zane Kennedy Published on 14th September 2023 Cybersecurity Researcher

A new malware, MetaStealer, is making waves by aggressively targeting Apple's macOS users, predominantly those in the business sector. This information-stealing malware has joined several other new info-stealer families, like MacStealer, Pureland, Atomic Stealer, and Realst, signaling an alarming trend.

Researchers from cybersecurity firm SentinelOne, who first brought MetaStealer to light, noted its distinguishing trait of focusing on Intel-based macOS machines, a move that is particularly significant given Apple's progressive transition to its own Silicon processors. There are concerns, however, about the potential for this malware to adapt and target newer architectures like M1 and M2 in the future.

Phil Stokes, a security researcher at SentinelOne, pointed out the sophistication of this malware's deployment. Attackers distribute MetaStealer via malicious application bundles in disk image format (.dmg). While masquerading as prospective design clients, the attackers send business employees the malicious payload, which is often named something innocuous. Some of these files are even disguised as Adobe files or software installers.

One user detailed their close encounter with MetaStealer on VirusTotal, where they received a password-protected ZIP archive containing the malicious DMG file from what seemed to be a genuine design client.

MetaStealer’s primary objective is data theft. Built as an obfuscated Go-based executable, it can extract keychain data, saved passwords, and even swipe files from the compromised host. Alarmingly, some versions of the malware have shown to also be able to target services like Telegram and Meta.

The exfiltration of keychain contents is particularly troublesome. For the uninitiated, the keychain is macOS's password management system, storing credentials for websites, apps, WiFi networks, certificates, and even sensitive financial data. Falling into the wrong hands, this information becomes a goldmine for cybercriminals.

Interestingly, there are similarities between MetaStealer and another macOS malware called Atomic Stealer, especially in regards to their shared tactic of disguising as TradingView apps. However, SentinelOne cannot confirm nor rule out that both these malware were developed and distributed by the same threat actors.

The rise of MetaStealer underscores the shifting focus of cybercriminals towards macOS, which historically has been perceived as more secure than other operating systems. To counteract this threat, Apple has recently introduced a detection signature for some versions of MetaStealer in its XProtect anti-malware system.

As this measure doesn’t cover every active version of MetaStealer, and with social engineering techniques becoming more refined, users must remain vigilant and exercise caution, especially when downloading files or engaging with unfamiliar contacts.

About the Author

Zane is a Cybersecurity Researcher and Writer at vpnMentor. His extensive experience in the tech and cybersecurity industries provides readers with accurate and trustworthy news stories and articles. He aims to help individuals protect themselves through informative content and awareness of cybersecurity's crucial role in today's digital landscape.