Banshee Stealer, a macOS-focused information-stealing malware, has resurfaced since its source code was leaked in late 2024. Banshee was first discovered in August 2024 under a malware-as-a-service (MaaS) model, being sold to cybercriminals for $3,000 a month for its data harvesting capabilities. Banshee is built to steal data from web browsers, cryptocurrency wallets, and system files. The latest variant of the malware introduces a new encryption method modeled on Apple’s XProtect built-in anti-malware tool. The advanced encryption allows the new Banshee variant to bypass antivirus systems and evade detection by blending in with normal operations. It is also notable that the variant removed a Russian language check criteria from its infection chain which previously prevented the malware from executing on hosts where Russian was set as the default system language. Banshee is being spread via phishing websites and fake GitHub repositories that purport to host legitimate software for download such as Google Chrome, Telegram, and TradingView. The continued development of Banshee should be a reminder that macOS systems are still susceptible to, and a target of malware infections. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.