MacSync Info-Stealer Evolves with Binary Droppers and iCloud Delivery

The MacSync info-stealer, a rapidly evolving malware family first advertised on the dark web in 2025 as Mac.c, has undergone a significant transformation. Initially resembling the AMOS stealer family and implemented as AppleScripts, MacSync has developed its own distinctive features, including a backdoor module. Researchers have recently identified a new infection chain, first observed in the wild in September 2026, which represents a substantial departure from earlier variants.

The most notable change is the shift from script-based droppers to binary droppers for payload delivery. Furthermore, the core malicious payload now comprises modules written in Objective-C and Swift, indicating a more sophisticated development approach. In a particularly interesting tactic, attackers are now using iCloud to host and distribute components of the infection chain, making it harder to block malicious infrastructure.

MacSync operates as a malware-as-a-service (MaaS), allowing operators to choose their preferred initial infection vectors. While social engineering and "ClickFix" style attacks have been common, attackers are also distributing MacSync disguised as legitimate software, including free or cracked applications and new software releases. One campaign observed by researchers involved a fake cryptocurrency wallet app named Toria, complete with a dedicated webpage and promotion on social media platforms like X and Telegram.

The latest observed infection chain begins with malicious DMG disk images. Within a single campaign, two distinct methods for delivering the infostealer and backdoor modules were identified. In one instance, the DMG contained a compiled JXA script that, upon execution, decoded a shell script and passed it directly to the interpreter without writing it to disk. In another variant, the script appeared later in the infection chain after a series of droppers and loaders had executed.

This more complex chain starts with a malicious .APP application within the DMG. Upon launch, it first removes any quarantine attributes associated with the application. It then extracts an XOR-encrypted URL from its overlay, decrypting it with a specific key. This URL, often pointing to a file on an attacker-controlled server or, in some cases, a public iCloud calendar, serves as the link to the next-stage downloader script.

When the calendar file is retrieved, the downloader uses an anonymous pipe and launches the interpreter to read commands. The contents of the calendar file are fed into this interpreter line by line. After parsing through the calendar's description, the malicious payload is executed. This payload downloads a .TAR.GZ archive from iCloud, which contains another .APP bundle. This bundle is then de-quarantined, ad-hoc signed, and executed.

This newly downloaded application acts as a dropper, extracting a zlib-compressed executable encrypted with AES. After decryption and unpacking, it's placed in the /tmp directory as another dropper. This second dropper includes anti-debugging measures, such as checking for virtual machine presence and using ptrace to prevent debugger attachment. The final payload is a shell script, also encrypted with AES, completing the infection chain and likely leading to the theft of sensitive user information.