How to remove Realst Infostealer (Mac)

What is Realst Infostealer

Realst Infostealer is a type of malware that specifically targets macOS systems, including the upcoming macOS 14 Sonoma. Its primary function is to steal valuable data from infected computers, including cryptocurrency wallet information, browser data, and stored passwords. Unlike many other malware types, Realst is coded in Rust, a programming language known for its high performance and memory safety, which adds an extra layer of sophistication to its operation. The first step in removing Realst Infostealer is to run a full system scan using reputable anti-malware software designed for macOS. Tools like Spyhunter and CleanMyMac are capable of detecting and eliminating Realst along with other threats. It’s crucial to ensure that the anti-malware software is up-to-date to recognize the latest malware signatures. For users comfortable with macOS’s inner workings, manual removal involves identifying and deleting malicious files associated with Realst. This process can be intricate due to the malware’s ability to hide and mimic legitimate files. Users should look for suspicious .pkg or .dmg files downloaded around the time of infection and any unknown applications installed without their consent. This article delves into the nature of Realst Infostealer, its infection mechanisms, and provides comprehensive strategies for its removal and prevention.

How Realst Infostealer infected your system

Distribution via Fake Blockchain Games: The primary distribution method of Realst Infostealer involves deceiving victims into downloading fake blockchain games. These games, with names like Brawl Earth, WildWorld, and Dawnland, are advertised on malicious websites and social media platforms. Each game is hosted on its own website, complete with associated Twitter and Discord accounts to create an illusion of legitimacy.
Phishing and Social Engineering: Another method of spreading Realst involves direct contact with potential victims through social media, offering payment in exchange for testing these fake games. This approach leverages social engineering to gain the victim’s trust and convince them to install the malware.
Malicious Installers: Once a victim is lured into downloading a game, they are presented with a .pkg or .dmg installer containing the Realst malware. Some versions of the malware are distributed using valid Apple Developer IDs or ad-hoc signatures to bypass macOS security measures like Gatekeeper.

Remove Realst Infostealer from macOS manually

Removing Realst Infostealer from macOS requires a systematic approach that involves a combination of built-in tools, safe computing practices, and sometimes third-party software. Here’s a comprehensive guide to identifying and removing viruses from your Mac, ensuring your system’s integrity and security.

Step 1: Disconnect from the Internet

1. Disconnect your Mac from the Internet. This prevents the virus from sending data to its creator or downloading more malicious software. Turn off Wi-Fi and unplug any Ethernet cables.

Step 2: Enter Safe Mode

2. Restart your Mac in Safe Mode. Safe Mode performs a check of your startup disk and restricts certain software from automatically loading or opening.
   • For Intel-based Macs: Restart your Mac and immediately press and hold the Shift key until you see the login window.
   • For Apple Silicon Macs: Turn off your Mac, press and hold the power button until you see the startup options window, select your startup disk, press and hold the Shift key, then click Continue in Safe Mode.

Step 3: Use Built-in Tools for Malware Removal

3. Use Finder to identify and remove suspicious applications.
   • Open Finder, go to the Applications folder, and look for any applications you don’t recognize or didn’t intentionally download.
   • Right-click the suspicious application and select Move to Trash, then empty the Trash.
4. Use macOS built-in malware removal tool (MRT). macOS automatically runs MRT in the background, but you can manually run a malware scan by updating your software.
   • Go to System Preferences > Software Update.
   • Install any available updates, as these often include the latest security improvements and malware definitions.

Step 4: Check and remove Realst Infostealer from Login Items

Note: Realst Infostealer may set up to start on macOS startup. Therefore, before starting the removal, perform these steps:

1. Open System Preferences, choose Users & Groups.
2. Choose your account (set up as Current User).
3. Click Login Items tab.
4. Find suspicious entries. Select it, and click the “-“ (minus) button to remove them.

Step 5: Check and remove Realst Infostealer Malicious Device Profile

Important update: Realst Infostealer can install malicious Device Profile called AdminPrefs or similarly on MacOS, that won’t allow users to make changes to browser search engine and homepage settings. Follow instructions below to remove this profile.

Remove Realst Infostealer profile

1. Go to System Preferences and click on Profiles.
2. In the list of profiles on the left side, choose AdminPrefs or other profile and click on “-” button to remove it.
3. In your case it can be named differently, in this case remove all visible profiles. Check the picture below to see how it looks like.

Step 6: Reset Your Web Browsers

Reset Safari:

1. Start Safari on your Mac, click Safari to open drop-down menu and choose Preferences
2. Go to the Privacy section of Safari’s preferences.
3. Click Remove All Website Data button.
4. In the opened window, click Remove Now button to remove data stored by websites in Safari.
5. Go to the Advanced section of Safari’s preferences.
6. Click the Show Develop menu in menu bar option.
7. In the menu, click Develop and select Empty Caches from this menu.
8. Again, go to Safari menu and choose Clear History….
9. Choose to clear all history and click Clear History button.

Reset Google Chrome:

1. Start Google Chrome browser
2. In address box type (or copy-paste) chrome://settings.
3. Scroll down and find Show advanced settings link.
4. Click on it and scroll down to the bottom again.
5. Click Reset settings button and click Reset to confirm.

Reset Mozilla Firefox:

1. Start Mozilla Firefox browser.
2. In address box type (or copy-paste) about:support.
3. Click Refresh Firefox… button.
4. Click Refresh Firefox to confirm.

Step 7: Restore from a Backup

8. If the issue persists, consider restoring your Mac from a backup.
   • Use Time Machine or another backup system to restore your Mac to a state before it was infected.
   • Ensure the backup you choose predates the malware infection.

Prevention Tips

• Keep your macOS updated. Regularly check for and install macOS updates to ensure you have the latest security patches.
• Be cautious with downloads and attachments. Only download software from trusted sources like the Mac App Store or official websites.
• Use strong passwords and enable two-factor authentication (2FA) where possible.
• Consider enabling the macOS firewall in System Preferences > Security & Privacy.
• Regularly back up your Mac using Time Machine or another backup solution to ensure you can recover your system if needed.

Following these steps should help you remove most viruses from your Mac. If you continue to experience issues, consider seeking help from Apple Support or a professional cybersecurity service.