Security researchers have identified a sophisticated new macOS malware strain dubbed “ShadowVault” that specifically targets Keychain credentials, browser-stored passwords, cryptocurrency wallets, and SSH keys on Apple systems.
Unlike previous macOS information stealers, ShadowVault employs a novel persistence mechanism that abuses legitimate macOS LaunchAgent configurations and signs its payload with stolen Apple Developer certificates, allowing it to bypass Gatekeeper protections on default macOS configurations.
Distribution Vectors
- Trojanized versions of popular developer tools distributed via compromised Homebrew taps
- Phishing campaigns targeting software engineers with fake code review requests
- Supply chain compromise of two popular VS Code extensions (now removed from marketplace)
Detection
Indicators include unexpected LaunchAgent plists in ~/Library/LaunchAgents/ with randomized names, outbound connections to Tor hidden services, and unauthorized Keychain access prompts.