Fake Windows Executables Target macOS: Inside the “MonetaStealer” Discovery

A new macOS threat named MonetaStealer has been discovered masquerading as a Windows executable, with the sample arriving as Portfolio_Review.exe and identified as an unsigned Mach-O binary. According to the analysis, it uses PyInstaller to bundle a Python environment and stores its malicious code inside a compressed file named portfolio_app.pyc, allowing it to bypass basic static file scanners that only inspect the Mach-O structure.

The malware targets high-value data after detecting it is running on macOS (darwin), focusing on Google Chrome passwords, cookies and history, cryptocurrency wallets such as Metamask, Exodus, Electrum, Phantom and Binance, and wallet seed phrases and private keys via regex. It also attempts to loot the macOS Keychain and Wi‑Fi credentials, running the native security find-generic-password command in the process.

Researchers note a Windows variant named Portfolio_review.exe exists but currently does not run due to dead logic and placeholders, and the sample is described as having a zero-detection rate on VirusTotal at the time of writing.