Iru Team
•
0 min readAnalyzing the MonetaStealer macOS threat
On January 6, 2026, security researchers at Iru discovered a suspicious Mach-O binary masquerading as a Windows .exe file. Investigation revealed the file is a PyInstaller-compiled binary that executes malware hidden within a .pyc file. Researchers named the malware MonetaStealer. The malware contains limited capabilities and lacks anti-analysis/persistence mechanisms. Researchers believe it is still in its very early this is a text link and relies heavily on AI code. MonetaStealer maintains a zero-detection rate on VirusTotal as of the time of writing.