MetaStealer

MetaStealer is an information-stealing malware family active since 2022 and commonly described as a derivative of RedLine with additional features and heavier obfuscation. It has been observed primarily on Windows and macOS, with Windows variants implemented in .NET and macOS variants delivered as heavily obfuscated Go-based Mach-O binaries. The malware is designed to harvest sensitive data from compromised systems, including browser credentials, cookies, saved passwords, files, and in some cases cryptocurrency wallet data. Documented Windows capabilities also include keylogging, hidden VNC-style remote access, arbitrary command execution, system reconnaissance, persistence via scheduled tasks, and defense evasion through Microsoft Defender exclusions. Some reporting also links MetaStealer activity to techniques for bypassing Chromium Application-Bound Encryption to recover protected browser secrets.

On Windows, MetaStealer has been observed using encrypted configuration data and runtime string deobfuscation, communicating with command-and-control infrastructure over HTTP using JSON-based tasking. Reported tasking includes browser data theft from Chrome, Edge, and Firefox, command execution, and collection of host information. Persistence has been established through scheduled tasks, and some samples rename themselves and store bot identifiers locally. MetaStealer infrastructure has also been associated with domain generation algorithms, including a newer wordlist-based DGA, while gate servers appear to rely more on transport and protocol characteristics than on any specific domain.

On macOS, MetaStealer emerged during 2023 as a business-focused infostealer distributed through malicious application bundles packaged in DMG or ZIP archives. Social-engineering lures have included fake client project materials and software-themed installers. macOS variants have been observed stealing keychain data, saved passwords, files, and in some cases data associated with Telegram and Meta services. These samples were single-architecture Intel binaries and generally required users to bypass normal Apple trust protections to execute.

Observed delivery methods include malvertising, fake software installers, business-themed lure files, and social-engineering campaigns impersonating legitimate software or services. MetaStealer has been delivered in campaigns involving spoofed tax-related brands, fake AnyDesk installers, and malicious Google Ads impersonating products such as Mozilla Thunderbird and Microsoft Teams. It has also been referenced among infostealers implicated in broader credential-exposure ecosystems, including compromises where previously stolen credentials were later abused against cloud services. MetaStealer is best characterized as a cross-platform commodity infostealer with credential theft, browser data theft, exfiltration, persistence, and post-compromise tasking capabilities.