MacSync Malware Evolves with Complex Delivery Chain Targeting Crypto and Developer Data

The MacSync information stealer, a rapidly evolving macOS threat, has resurfaced with a significantly more complex delivery mechanism designed to ensnare users interested in cryptocurrency and development tools. Moving beyond simpler methods like pasted Terminal commands, the latest campaigns begin with malicious disk-image files (DMGs) that masquerade as legitimate applications. These fake applications, including a non-existent cryptocurrency wallet named Toria, are promoted on social media, luring unsuspecting users into downloading and executing them.

Once a victim launches the malicious application, it can bypass macOS's built-in security features, such as stripping quarantine attributes, enabling the download and execution of further malicious code. The ultimate goal is to install a suite of tools designed to pilfer sensitive data, including passwords, cryptocurrency wallet information, and work-related credentials. Analysts at Securelist observed this shift in September 2026, noting a departure from script-heavy delivery methods towards compiled components written in Swift and Objective-C. This evolution makes MacSync more adaptable and harder to detect on both Apple Silicon and Intel-based Macs.

The stolen information can include browser sessions, cloud service keys, SSH configurations, source control data, and cryptocurrency wallet details. This broad scope of data theft not only compromises personal accounts but also opens avenues for attackers to infiltrate corporate environments, as demonstrated by previous MacSync campaigns involving fake installers. While the exact scale of current infections remains unclear due to a lack of reported victim numbers, the sophistication of the attack chain suggests a potentially widespread threat.

The attack chain involves several stages. A malicious DMG contains an application bundle that, in one variant, executes a compiled JXA script directly in memory. In another, a loader script navigates through multiple dropper stages before fetching the final components. This multi-stage approach is a notable evolution from earlier delivery methods. One loader retrieves an encrypted address and, in some instances, accesses a public iCloud calendar to hide commands, which then download an archive containing the next stage of malware. This clever use of a public calendar turns a standard sharing feature into an unexpected vector for malware distribution.

Subsequent stages involve decrypting an information stealer and a backdoor. The malware employs temporary and lock files to manage its execution flow, and completed modules are designed to erase logs and other traces of activity. MacSync also incorporates anti-analysis techniques, such as checking for virtual machines and blocking debuggers, significantly complicating forensic investigations. These measures aim to hinder security researchers and make it more difficult to assess the extent of an infection on compromised devices.

Persistence is a key feature of the evolved MacSync. The malware can masquerade as the Finder application and maintain its presence through LaunchAgents, ZSH startup settings, and global Git hooks. Its self-repair routine can restore files and suppress startup notifications, ensuring that simply removing the initial malicious application does not end the intrusion. This persistence mechanism is crucial for long-term data exfiltration and maintaining access to the compromised system.

The Swift-based information stealer employs a sophisticated social engineering tactic by presenting a tailored administrator password prompt that mimics the legitimate application it is imitating. Upon receiving the password, it displays a fake error message about a damaged application to mask the successful credential theft. It leverages macOS's native authentication interfaces for password verification, a more robust method than older command-line approaches. The collected data includes browser history, cookies, saved logins, Keychain files, Telegram data, and device information, along with configuration files and histories related to SSH, ZSH, AWS, Kubernetes, and Git, thereby extending its reach into software development workflows and potentially exposing access details for cloud services and repositories.

The backdoor component communicates over HTTP, capable of receiving commands, uploading files, deploying browser extensions, or even replacing installed Ledger wallet applications with malicious versions. A live-browser function may allow for the interception of browser traffic, though its exact purpose remains under investigation. To mitigate risks, users are strongly advised to download software exclusively from verified developer websites, avoid cracked or free software, and never bypass macOS security warnings or execute unverified commands. Teams should also monitor for unfamiliar startup items, altered Git hooks, and suspicious outbound network activity.

This latest analysis reveals a novel persistence and evasion technique employed by the MacSync malware: it uniquely hides malicious commands within an iCloud calendar. Furthermore, the malware now utilizes the Pluggable Authentication Modules (PAM) API for password verification, a departure from typical macOS malware behavior and a technique previously observed in the Pam Stealer family.