According to SlowMist CSO 23pds, MioLab is a commercialized macOS malware-as-a-service platform promoted on Russian-language underground forums with crypto-theft modules targeting Ledger and Trezor wallets.
SlowMist said MacSync Stealer v1.1.2 is actively spreading and targeting macOS users by stealing crypto wallets, browser credentials, Keychain data, and SSH, AWS, and K8s keys. The security firm said the malware uses fake AppleScript system prompts to harvest passwords, then displays a false “system not supported” error after data exfiltration. In a new update, SlowMist CSO 23pds said MioLab is a commercialized macOS malware-as-a-service platform advertised on Russian-language underground forums, offering C2 control, API integration, and modules aimed at stealing crypto assets from Ledger and Trezor hardware wallets.