MacSync, a macOS-focused information stealer and remote-access stager sold through a malware-as-a-service (MaaS) model, is targeting Apple users through ClickFix lures, search-engine malvertising, and fake software download pages.
The malware relies on social engineering instead of exploiting a software vulnerability. Victims are directed to fraudulent pages impersonating popular brands, including Google Meet, Zoom, Claude AI, ChatGPT, Cloudflare, Docker, Notion, Cursor, TradingView, and cryptocurrency applications.
The pages display fake errors, CAPTCHA checks, or installation prompts that instruct users to copy and run a command in macOS Terminal. Once executed, the command launches a lightweight native Mach-O stager.
The malicious binary silently detaches from the Terminal session using the fork() and setsid() functions, then redirects standard input, output, and error streams to /dev/null.
This prevents visible error messages and helps the malware operate in the background without alerting the victim.
MacSync samples also use single-byte XOR obfuscation with the 0xAA key to hide command strings, temporary paths, API headers, and command-and-control (C2) addresses from static security scans.
The sample analyzed was an ad-hoc signed 64-bit x86_64 Mach-O executable using the signing identifier com.utils.Launcher.
MacSync ClickFix Wallet Heist
The stager contacts its C2 infrastructure over HTTPS and downloads a dynamic AppleScript payload. Rather than saving the script to the device, MacSync pipes the server response directly into macOS’s native osascript utility.
This fileless approach lets operators modify the stealing logic on their servers without rebuilding and redistributing the main binary.
The AppleScript can collect sensitive data from infected Macs, including browser credentials, cookies, macOS Keychain data, SSH keys, Telegram sessions, cloud tokens, environment files, and cryptocurrency wallet databases.
Targets may include MetaMask, Phantom, Coinbase, TronLink, Exodus, and Electrum wallet data.
Collected information is stored in a temporary archive named /tmp/osalogging.zip. MacSync then divides the archive into 10 MB segments and uploads each part through HTTP PUT requests.
The malware retries failed uploads with increasing delays, improving the likelihood of successful theft on unstable connections.
After receiving a successful server response, it removes both the archive and the temporary /tmp/.httpcode status file. This cleanup activity reduces forensic evidence left on compromised endpoints.
MacSync campaigns appear designed to reach software developers, remote employees, cryptocurrency traders, Web3 users, and enterprise staff.
Fake Docker, Cursor, Claude AI, and Notion installers can target developers with access to cloud credentials, source code, and CI/CD environments.
Fake Google Meet or Zoom troubleshooting prompts may steal corporate session tokens, Keychain data, and identity-provider credentials, seqrite said.
Indicators of Compromise
| IOC Category | Indicator | Description |
|---|---|---|
| SHA-256 | 9ff32f7c0108e9d27a3b491edf04827b6ca025f44db68aeadc44eeb97c9aab11 | MacSync native Mach-O stager binary |
| SHA-1 | 59508d071661ea70fa5fcbe6f9e2fb72506e57df |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
 model, is targeting Apple){kind=link}