iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
MetaStealer is a Go-based macOS information stealer that SentinelOne researchers reported in September 2023. It was designed to take sensitive data—including Keychain information, saved passwords and files—and was delivered in at least some reported cases through business-themed social engineering. That reporting documents activity and samples seen in 2023; it does not establish that MetaStealer is active today.
How MetaStealer was reported to target business users
SecurityWeek’s September 13, 2023 report, summarizing SentinelOne’s findings, described MetaStealer as a heavily obfuscated macOS infostealer written in Go. The operators reportedly posed as business clients to persuade employees to open a malicious application bundle delivered in a DMG disk image.
One sample uploader told SecurityWeek that someone they had been negotiating with about a design job sent a password-protected ZIP containing a DMG. This is an anecdotal account associated with an uploaded sample, not independently verified evidence about a named company or proof that every MetaStealer infection used that lure. It does illustrate why an apparently ordinary work exchange can make an unexpected installer feel plausible. BleepingComputer’s coverage also summarized the client-impersonation approach.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What data could MetaStealer expose?
The 2023 analysis reported capabilities to exfiltrate Keychain data, harvest saved passwords and steal files. It also identified apparent targeting of Telegram and Meta applications. Stolen credentials or work files could create a path to organizational accounts or expose business information, but the reporting describes potential risk—not a confirmed breach at a specific company. SentinelOne’s technical analysis details the observed capabilities.
#1 Best Overall
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
What the 2023 detection findings do—and do not—show
SentinelOne reported that most samples it observed lacked code signatures or ad hoc signing, so a victim would generally need to override macOS protections such as Gatekeeper to run them. The report also said some samples observed in June and July 2023 remained undetected by an Apple XProtect update released in September 2023. These are observations about particular samples at that time, not a current evaluation of Gatekeeper or XProtect, nor a reason to assume either protection will always block or always miss a threat. SecurityWeek’s report records those dated findings.
Is MetaStealer related to Atomic Stealer?
Researchers noted very limited code overlap between MetaStealer and Atomic Stealer, another Go-written macOS stealer. They did not establish shared developers or operators: similar techniques can also be used independently. The reported overlap is not enough to attribute MetaStealer to the people behind Atomic Stealer. The original coverage describes that uncertainty.
Rank #2
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
What the later macOS stealer landscape means for defenders
Later reports provide useful platform context but should not be mistaken for evidence that MetaStealer continued operating. Microsoft’s February 2026 overview describes other macOS infostealer campaigns using social engineering, malvertising redirects, fake installers and ClickFix-style prompts. Its broad defensive guidance includes training users to recognize lures, discouraging unsigned DMGs and unofficial utilities, and monitoring suspicious Terminal activity and use of native tools.
Microsoft’s August 2026 ClickFix reporting discusses a campaign delivering MacSync or Atomic Stealer (AMOS). A separate MacSync analysis describes suspicious shell activity, AppleScript-assisted commands, curl-based payload retrieval, credential-store access, staging, archiving and upload behaviors. Those details belong to the reported MacSync and AMOS activity; they are not MetaStealer indicators.
Rank #3
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Red Canary’s 2025 Threat Detection Report recorded a 400 percent increase in macOS threats in its telemetry from 2023 to 2024, driven in large part by stealer threats including Atomic, Poseidon, Banshee and Cuckoo. That is Red Canary’s observed telemetry, not a measure of MetaStealer prevalence or a census of all Macs.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Practical steps for organizations
- Verify unexpected work files. Confirm a client’s identity and the reason for an installer through a separate, trusted channel before opening it—especially when a job-related contact sends a password-protected archive or asks you to bypass a security warning.
- Use trusted software sources. Set expectations against installing unofficial utilities or opening unsigned DMGs for routine work. Establish an approved process for software requests rather than asking employees to make ad hoc security exceptions.
- Monitor behavior, not a borrowed IOC list. Review suspicious Terminal activity and use of native tools in context, following current macOS threat guidance. Do not treat behaviors documented for MacSync or AMOS as confirmed MetaStealer indicators.
- Respond to a suspected execution promptly. Use your organization’s incident-response process to isolate the Mac as appropriate, preserve relevant endpoint and account evidence, and assess whether credentials or files may have been exposed. Rotate affected credentials and revoke sessions where warranted by that assessment.
The MetaStealer-specific public account remains anchored to samples uploaded from March through August 2023, with the latest sample noted by SecurityWeek uploaded August 27, 2023. Those dates describe the historical sample timeline in that report, not a live activity feed. The available reporting therefore supports treating MetaStealer as a documented 2023 threat while applying broader, current macOS defenses to newer campaigns.
Quick Recap
Best Value
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Rank #4
![Norton 360 Premium 2027 Antivirus, 10 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41JNWru8mYL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 10 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
