A PYTHON IN DISGUISE: UNPACKING PYINSTALLER MALWARE ON MACOS

Summary from the TLDR InfoSec newsletter

Attackers use PyInstaller to package malicious Python code into standalone Mach-O executables for macOS, eliminating the need for Python installation. This attack involves bundling obfuscated infostealer code (string reversal, base85 encoding, XOR encryption, and zlib compression) that extracts credentials from password prompts, executes malicious AppleScript, steals from the keychain, and targets cryptocurrency wallets. Upon execution, these binaries create temporary directories with the extracted Python libraries and malicious code, which exist only during the malware's runtime.