KEYSTEAL Trojan Targets Macs To Steal Data
KEYSTEAL is the name of a Trojan malicious application. As the name suggests, KEYSTEAL is developed to steal information contained in a Mac's Keychain password storage.
Keychain is a proprietary Apple password management system that was introduced two decades ago and has been updated and modernized over time. The system is used for securely storing and easily accessing various types of sensitive information strings, including passwords, keys and certificates.
The malware is distributed using a weaponized installer of the ResignTool app for Mac - software used to "re-sign" apps to be bundled into IPA-format files for installation on Mac computers.
The ResignTool software is available on Github but it's not found on the official Apple Store. This means malicious actors can distribute the doctored malicious installer packages containing the KEYSTEAL Trojan using third-party websites.
Once installed the Trojan will also ask for the user's account password, making it a particularly dangerous piece of malware.