Loading malware…
NovaStealer is a macOS-focused infostealer associated with cryptocurrency theft activity. It has been observed targeting Mac users, particularly cryptocurrency holders, and is designed to exfiltrate wallet-related files, collect host telemetry, and tamper with installed cryptocurrency wallet applications by replacing legitimate Ledger and Trezor software with trojanized copies. Reported tradecraft includes use of a dropper that installs an orchestrator in the user context, establishes persistence via a LaunchAgent, and retrieves base64-encoded scripts from command-and-control infrastructure for execution in detached terminal sessions. NovaStealer has also been linked to delivery chains using shell-command execution on macOS, including campaigns leveraging ClickFix-style social engineering. In mid-2026 reporting, NovaStealer appeared as a relatively small but active component of the broader macOS stealer ecosystem. Its behavior aligns with financially motivated macOS malware focused on credential and wallet theft, persistence, and stealthy post-compromise tasking.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The campaign coincides with the disclosure of a high-severity OpenClaw vulnerability (CVE-2026-25253) that enables one-click remote code execution through token exfiltration and WebSocket hijacking. Although patched in late January 2026, the flaw points to the platform’s growing attack surface.
4 distinct techniques documented for this family, organized by ATT&CK tactic.
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A named macOS stealer family appearing at low prevalence in the reporting period.
Information-stealing malware delivered via malicious OpenClaw “skills,” used to harvest sensitive data (e.g., API keys, credentials, cloud secrets) from infected systems.
macOS stealer that targets cryptocurrency users by exfiltrating wallet-related files and telemetry, and by replacing legitimate Ledger/Trezor apps with trojanized versions. Uses a dropper to install a script orchestrator (~/.mdrivers) and persistence via a LaunchAgent (application.com.artificialintelligence), then pulls additional base64-encoded scripts from C2 and runs them in detached screen sessions.
NovaStealer is an infostealer malware targeting macOS systems, designed to steal sensitive information from infected devices.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.