• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    MAL OSX Koi Stealer Feb25

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Matt Brady@mbrady5299
    •updated Aug 14, 2025•1•0•23

    Detects the Koi Stealer macOS variant, an infostealer targeting cryptocurrency wallets and sensitive user data. This malware is linked to North Korean threat actors.

    YARA

    Tags

    T1005 - Data from Local SystemT1119 - Automated CollectionT1555.003 - Credentials from Web BrowsersT1027 - Obfuscated Files or InformationTA0009 - CollectionTA0006 - Credential AccessTA0005 - Defense EvasionCRIMEAPTINFOSTEALERKOI_STEALERMACOSFILE

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?