macOS Stealer (DriveSurge campaign / fake com.apple.syslogd)

DriveSurge_Campaign_Stealer.md

IOCs

Stealers observed in the DriveSurge campaign (Silent Push: ClickFix + fake update driveby attacks on thousands of compromised sites). Two stage macOS malware with dedicated arm64 (Apple Silicon) and x86_64 (Intel) builds, obfuscated bash loader → ~30MB Garble Obfuscated Go stealer. Steals 100+ crypto wallets, macOS Keychain, browser creds/cookies, SSH/GPG keys. Patches Atomic Wallet & Exodus Electron apps to intercept passwords. Shows fake Ledger Live / Trezor Suite "security update" dialogs to phish 24-word seed phrases. Persistence via LaunchAgent + ~/.persistenced.

C2 / Telemetry Servers (POST /api/t)

http://89.208.97.111:8133/api/t
http://45.155.71.15:8133/api/t
http://213.165.42.172:8133/api/t
http://193.32.8.101:8133/api/t
http://147.45.42.172:8133/api/t
http://78.153.130.50:8133/api/t
http://138.124.59.171:8133/api/t
http://213.176.66.224:8133/api/t

Payload Distribution Servers

http://46.226.162.241/d90acb823cb7c7?force=1      (arm64)
http://46.226.162.241/211f79a06c?force=1          (x86_64)
http://77.221.153.43/6a528736795b?force=1
https://193.29.224.151/92392991a0cca55?force=1
http://46.226.162.82/6862ccf58a464?force=1
http://77.221.152.34/92392991a0cca55?force=1

Hashes (Stage 1 dropper payload, ~5 KB)

829aa6c933fd451152cd3138ef796845c675bcb32a8cd06c1131b4b5dc66177c

Hashes (Stage 2 payload, ~30 MB)

SHA-256 (arm64 / Apple Silicon):  04b8d6f7158689a311b22200c4c0fb5186a6751a422b5510b5a5fbf1c2a9cd5f
SHA-256 (x86_64 / Intel):         4c48cbbd55ff2b63a1fca862b8bb8ff00eec90050b2a2608140bbb3b2ad03f54
CDHash (arm64):                   8185fee51f8e534701ca1aca693bb29f7f5d015f
Codesign: arm64 adhoc (Identifier=payload_arm64); x86_64 unsigned (loader ad-hoc signs post-download)

Additional samples:
37f8cb100d97a167f5b93123db79967047166fd4563b037694371ef5fb6ad6c6
2716c090df69e5e64d9ed7c078c8fa904ac1ec06d609f1350ca6c253e7261320
f0062f7e70e61493684a2f60748a475168e155bc2502163c844c42e87692abd0

File / Host IOCs

~/Library/Caches/com.apple.system/com.apple.syslogd   (fake syslogd — legit one is /usr/sbin/syslogd)
Patched app.asar inside Atomic Wallet.app / Exodus.app
Process named "com.apple.syslogd" running from ~/Library/Caches/

Behavior IOCs

• xattr -d com.apple.quarantine + codesign --force --sign - on downloaded binaries
• Last line of ~/.zsh_history / ~/.bash_history deleted
• Fake dialogs: "Trezor Suite has detected a critical security update...", "A data integrity error has been detected in your Ledger Live application..."
• JS exfil artifacts: AtomicPassword.txt, AtomicWalletData.txt, ExodusPassword.txt, ExodusSeedEncrypted.txt, LedgerSeed.txt, TrezorSeed.txt
• Persistence config: "persistence_delay_minutes": 15