BlackHat USA Arsenal: MachStealer: One Pipeline Behind Every macOS Infostealer

GitHub: https://github.com/ultra-supara/MachStealer
BlackHat: https://blackhat.com/us-26/arsenal/schedule/index.html#machstealerone-pipeline-behind-every-macos-infostealer-52134
video: https://youtu.be/mzyQ9-8qsFg

macOS infostealers are the fastest-growing malware category on Apple platforms, with a 400% year-over-year increase in detections. AMOS, Poseidon, Banshee, Cthulhu, and Cuckoo all follow the same credential harvesting pipeline, Keychain extraction, PBKDF2 key derivation, SQLite database copy, and AES decryption. Understanding one family's harvesting stage reveals the mechanics of them all.

MachStealer is an open-source PoC tool for macOS Apple Silicon that reproduces this shared pipeline for security research. It implements the complete Chrome credential extraction chain with parameters matching Chromium's source code exactly.

Feature Overview
- Cookies: session tokens and auth cookies, AES-128-CBC encrypted
- Login Data: saved usernames and passwords, AES-128-CBC encrypted
- Credit Cards: card numbers, expiration dates, and cardholder names, AES-128-CBC encrypted
- History: URLs, titles, and visit frequency, unencrypted
- Extensions: installed extensions with version and store metadata, unencrypted

MachStealer deliberately omits the exfiltration layer: no C2, no network upload, no persistence, no anti-analysis evasion. By isolating the local harvesting stage, the tool serves as a safe, transparent model for defenders to validate EDR detection, develop behavioral signatures, and assess credential exposure risk. MachStealer also enumerates all Chrome profiles on the system with display names and associated email addresses, reproducing the profile iteration behavior of real infostealers.

Transcript

1. MACHSTEALER One Pipeline Behind Every macOS Infostealer github.com/ultra-supara/MachStealer · MIT · Education & research only Black Hat USA 2026 · Arsenal · Track: Malware
2. WHOAMI ATSUSHI SADA Security Engineer Ethical Hacker and Practical Security Research with offensive, defensive and AI/LLM capabilities.Firefox BBP,BlackHat US, DEFCON DemoLabs Presenter Cloud, Malware, Browser, Enterprise Security linkedin.com/in/atsushi-sada-a07736272/ 02
3. AGENDA 01 The macOS stealer problem 02 What MachStealer is 03 Inside the pipeline 04 Mapping to real families 05 Live demo 06 Defense & takeaways 03
4. THE PROBLEM EVERY MACOS STEALER REINVENTS THE SAME WHEEL. AMOS, Poseidon, Banshee, Cthulhu, Cuckoo — distinct MaaS brands, nearidentical credential theft. Different packaging, one underlying technique stack. 04
5. 0 2 — W H AT I T I S A MINIMAL, LOCAL-ONLY POC OF THE STEALER PIPELINE Local-only Decrypts Chrome credentials and prints them to stdout. No upload, no C2 — runs entirely on the host. THE PIPELINE 05 Apple Silicon only macOS ARM64 (M1/M2/M3+). Refuses to run on Intel — architecture is verified at startup. Keychain → master key → AES-128-CBC → SQLite read → stdout PoC scope Only the parts needed to reproduce the technique — backed by 61+ tests & 15+ benchmarks. Go · MIT licensed.
6. 03 — ARCHITECTURE A FOUR-LAYER HARVESTING PIPELINE 01 Keychain Integration Read the Chrome Safe Storage key from the login Keychain. → 02 PBKDF2 Derivation PBKDF2-HMAC-SHA1 → 128-bit AES key, matching Chromium exactly. → 03 Decryption Engine AES-128-CBC and AES-GCM; strip the v10 header, then decrypt. → 04 Data Extraction Copy locked SQLite DBs to temp, parse schemas, print to stdout. MachStealer stops at stdout. Real families bolt C2 and exfiltration onto these same four layers — so understanding this pipeline is understanding all of them. 06
7. SECTION 03 STEP BY STEP Three steps from a locked Keychain to plaintext credentials — the exact sequence shared across the MaaS ecosystem. 07
8. STEP 01 KEYCHAIN SAFE STORAGE Chrome's encryption secret lives in the login Keychain as "Chrome Safe Storage". Automatic — retrieval triggers a macOS permission prompt. Manual — pass the value via -sessionstorage to skip the prompt. # Retrieve Chrome's Safe Storage key $ security find-generic-password \ -wa "Chrome" # → system permission prompt (auto path) # Or extract once, reuse without prompt: $ ./MachStealer-darwin-arm64 \ -kind cookie -sessionstorage <key> 08
9. STEP 02 PBKDF2 KEY DERIVATION The Safe Storage value is stretched into the AES key with fixed, public parameters — a 1:1 match with Chromium's os_crypt_mac.mm, identical in every stealer. S A LT I T E R AT I O N S "saltysalt" 1003 HASH KEY LENGTH SHA-1 128-bit # Derive the AES master key masterKey = PBKDF2( safeStorageKey, salt = "saltysalt", iter = 1003, hash = SHA-1, dkLen = 16 ) 09
10. STEP 03 AES DECRYPT & SQLITE READ Copy first. Chrome holds DB locks while running — copy to a temp path before reading. Decrypt two ways. Strip the v10 header, then AES128-CBC (macOS) or AES-GCM (v80+) with the master key. Parse plainly. History & extensions are unencrypted — read straight from SQLite / JSON. # 1 · copy locked DB to temp cp ~/…/Chrome/Default/Cookies /tmp/c # 2 · detect format, strip 3-byte header mode = blob[:3] // v10 → CBC / GCM plain = decrypt(blob[3:], key, iv = 0x20 * 16 // CBC: 16×space ) # 3 · history / extensions = no crypto 10
11. FROM ONE BINARY WHAT IT HARVESTS -kind cookie -kind logindata -kind creditcard -kind history -kind extension Cookies Passwords Cards History Card number, expiry and holder from credit_cards (Web Data). Browsing history from the urls table, sorted by visit count. Extensions E N C RY PT E D E N C RY PT E D E N C RY PT E D P L A I N T E XT P L A I N T E XT Live session tokens, read from the cookies table. URL, username and decrypted password from the logins table. Installed extensions, parsed from Preferences JSON. Every database is copied to a temp file first to bypass Chrome's locks. All profiles ( Default , Profile 1 …) — with display name and email — are enumerated via -profile . 11
12. 04 — MAPPING TO REAL FAMILIES SAME PIPELINE, EVERY FAMILY MachStealer AMOS Poseidon Banshee Cthulhu Cuckoo – Persistence – – • • • • • • • • • • • • • • C2 / Exfiltration • • • • • • • • • • • • History / extension enumeration • • • • • • – – Anti-analysis / VM detection – • – • – • • • • • • • • • TECHNIQUE Keychain Safe Storage extraction PBKDF2 key derivation AES-128-CBC decryption SQLite copy & read Cookie / credential / card theft • present – absent Pink block = MachStealer's deliberate exclusions Family attribution sourced from SentinelOne · Malwarebytes · Elastic Security Labs · The Hacker News · Kandji 12 – – •
13. ETHICS & SCOPE NO C2. NO EXFIL. NO PERSISTENCE. NO EVASION. MachStealer reproduces the harvesting pipeline and stops at stdout. A scalpel for understanding the technique — never a weapon. Education and research only; unauthorized access is illegal. 13
14. SECTION 05 LIVE DEMO From a clean Apple Silicon Mac to decrypted Chrome credentials — in four commands. 14
15. 05 — LIVE DEMO THREE LIVE SCENARIOS On a live Apple Silicon Mac · ~3 min total 01 ~1 MIN 02 ~1 MIN ~1 MIN Full Pipeline Cards & Financial Reconnaissance Keychain prompt fires on first run PBKDF2 → AES-128 master key Decrypt cookies (v10 → CBC) Locate the Web Data database credit_cards schema walk-through Recover number, expiry, holder Enumerate profiles + emails History ranked by visit count High-value targets: banking, crypto Recover saved passwords End-to-end in under 10 s Enterprise exposure framing List extensions: managers, wallets terminal output terminal output or browse files 15 03 or browse files terminal output or browse files
16. 06 — DEFENSE & DETECTION BREAK THE PIPELINE, BREAK THE FAMILY Watch the Keychain Watch the SQLite copies EDR on the Chrome dir Raise the crypto floor Flag non-browser processes reading Chrome Safe Storage. Treat unexpected permission prompts as a signal, not noise. Monitor reads of ~/Library/Application Support/Google/Chrome from unsigned or unexpected processes. Alert when Cookies / Login Data are copied to temp by non-Chrome binaries. Favor passkeys and hardware-backed keys over stored passwords; appbound encryption raises the cost of this whole technique. A safe, transparent model of the harvesting stage , validate your EDR, build behavioral signatures, train responders. One detection on the pipeline covers AMOS, Poseidon, Banshee, Cthulhu and Cuckoo at once. 16
17. TA K E AWAY ONE PIPELINE BEHIND EVERY MACOS INFOSTEALER. Brands change, exfiltration changes, evasion changes. The credential-theft core does not. Learn the pipeline once — defend against the whole ecosystem. 17
18. THANK YOU REPOSITORY SESSION github.com/ultra-supara/ MachStealer /in/atsushi-sada REPOSITORY TALK · EN TALK · JA /ultra-supara/MachStealer youtu.be/mzyQ9-8qsFg youtu.be/9KyRqy37Iao 18 C O N TA C T Black Hat USA 2026 Arsenal · Malware Atsushi Sada linkedin.com/in/atsushi-sada LINKEDIN