Apple Security Researcher Claims Threat of MacOS Ransomware Banshee Is Exaggerated

BlockBeats News, January 14th, Researcher from the cybersecurity company Check Point recently revealed that a new macOS malware, Banshee, successfully evaded antivirus detection for over two months by leveraging Apple's security tool encryption scheme. Forbes warned that the malware poses a "genuine danger," and New York Post cited Check Point's report, stating that over 100 million Apple users could "fall victim."

However, Patrick Wardle, CEO of endpoint security startup DoubleYou, stated in an interview: "This particular sample really isn't that special." He believed that this situation might be more of a hype than an actual threat. While the malware appears to target "software-based encrypted wallets" and is still concerning, Wardle thought it had received an excessive amount of media attention.

The malware operates in the form of a $3,000 "theft-as-a-service," targeting cryptocurrency wallets and browser credentials. In November last year, the malware's source code leaked on underground forums, leading its creator to shut down the service, abruptly ending its operation. Banshee's uniqueness lies in its clever imitation of Apple's XProtect antivirus string encryption algorithm, allowing it to operate stealthily from late September to November 2024 without detection. Check Point's analysis explained that this strategy helped it evade security tools while targeting encrypted users through malicious GitHub repositories and phishing websites. (Decrypt)