Notifications
Clear all
Topic starter
11/07/2026 8:22 pm
TL;DR: macOS infostealers including KeySteal, Atomic InfoStealer and CherryPie continue to evade static signatures and some VirusTotal detections, while using anti-analysis checks, persistence and stolen Keychain access to stay active, according to SentinelOne. Signature-only defence is now an incomplete control for endpoints that store credentials and session material.
NHIMG editorial — based on content published by SentinelOne: macOS infostealers evading known signatures in early 2024
By the numbers:
- 2024 has already seen a number of stealer, tealer families evade known signatures.
Questions worth separating out
Q: What breaks when macOS infostealers evade static signature detection?
A: Static detection fails when the malware family changes packaging, code paths or signatures faster than defenders can update rules.
Q: Why do macOS infostealers create identity risk beyond the endpoint?
A: Because the stolen material is often reusable identity material, not just local files.
Q: How do security teams know if macOS stealer defences are actually working?
A: They should look for reduced dwell time, faster isolation of suspicious hosts and fewer successful credential reuses after an endpoint alert.
Practitioner guidance
- Harden macOS telemetry around credential stores Instrument access to Keychain, browser profile stores and suspicious AppleScript execution so investigations can tie local activity to credential access.
- Hunt persistence in LaunchAgents and LaunchDaemons Baseline the normal contents of /Library/LaunchDaemons and ~/Library/LaunchAgents, then alert on unexpected plist creation, renamed binaries and ad hoc signed executables.
- Move beyond static signatures on macOS Add behaviour-based controls for VM detection, terminal blocking, Gatekeeper tampering and low-reputation binaries in addition to XProtect and AV signatures.
What's in the full article
SentinelOne's full post covers the operational detail this post intentionally leaves for the source:
- Indicators of compromise for KeySteal, Atomic InfoStealer and CherryPie that threat hunters can operationalise.
- Sample naming, hash data and C2 detail for each stealer family.
- AppleScript, Gatekeeper and LaunchAgent artefacts that help defenders build macOS detection logic.
- Per-family behavioural notes that support incident response and malware triage.
👉 Read SentinelOne's analysis of active macOS infostealers and evasion tactics →
macOS infostealers are evading signature detection. What should teams do?
Explore further
11/07/2026 8:52 pm
Signature-only endpoint defence is no longer a defensible assumption for macOS identity risk. These stealer families show how quickly malware authors can move around static rules while keeping the same underlying objective: credential theft. The problem is not just malware churn, it is that endpoint compromise now feeds directly into identity abuse. Practitioners should treat detection depth as part of identity governance, not only endpoint operations.
A question worth separating out:
Q: Who is accountable when stolen macOS credentials are reused elsewhere?
A: Accountability usually spans endpoint security, identity governance and the application owners who trust the exposed credentials. If a user laptop can produce valid tokens for cloud systems, then control owners must jointly manage revocation, reauthentication and access scope. NIST CSF and access-control governance are both relevant.
👉 Read our full editorial: macOS infostealers keep bypassing static detection in 2024
