Loading malware…
MacSync is a macOS information-stealing malware family distributed under a malware-as-a-service model. First advertised in 2025 as Mac.c and subsequently renamed, it targets both Intel and Apple Silicon Macs, with campaigns emphasizing developers, cryptocurrency users, and IT-related users. Updated variants identified in September 2026 combine a Swift-based infostealer with an Objective-C backdoor and use compiled, multistage loaders and droppers.
Distribution methods include ClickFix prompts, malicious advertisements, counterfeit installation guides, cracked software, and fraudulent applications packaged as DMG disk images. Campaigns have impersonated Claude Code installation instructions through sponsored search results and legitimate shared AI conversations, as well as promoted a fictitious cryptocurrency wallet called Toria. Some infection chains retrieve commands concealed in public iCloud Calendar event descriptions and execute them through the macOS shell to download subsequent stages.
MacSync uses fraudulent password dialogs to capture the user's administrator password and validates submitted credentials through macOS authentication interfaces. It collects browser passwords, cookies, session information, browsing history, Keychain material, cryptocurrency-wallet application and extension data, Telegram data, Apple Notes, and sensitive documents. Developer-focused collection includes SSH keys, cloud credentials, AWS and Kubernetes configurations, Git authentication material, and shell histories. Collected information is staged, archived, and exfiltrated, including through chunked HTTP uploads.
The backdoor executes attacker-supplied AppleScript, collects additional files, installs browser extensions, and can replace installed Ledger wallet software with an attacker-provided version. Persistence mechanisms include LaunchAgents, shell startup configuration changes, global Git hooks, and restoration routines that repair removed components. Defense-evasion measures include encrypted payload delivery, in-memory execution, virtual-machine detection, anti-debugging checks, removal of quarantine metadata, deletion of temporary artifacts and logs, and suppression of macOS background-task notifications.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
"Threat Details and IOCs Malware: Mac.c, MacSync, MacSync Stealer CVEs: CVE-2023-31290"
36 distinct techniques documented for this family, organized by ATT&CK tactic.
Vecteurs observés : ... Scripts JXA compilés ou chaînes de droppers/loaders.
« Artefacts publiés directement sur les plateformes officielles [...] redirigeant vers des domaines de backup ou des commandes curl malveillantes. Payload identifié : MacSync Stealer (8/12 analyses). »
«приложение... извлекает зашифрованный URL следующего этапа»; «Один извлекает зашифрованный бинарник».
Le malware se déguise en applications populaires gratuites ou crackées; la persistance comprend com.apple.finder.agent et $HOME/Library/Application Support/System.
Les droppers déchiffrent des exécutables et scripts AES-CBC; le script principal utilise ECDH Curve25519 + AES-GCM pour les modules finaux.
«второй проверяет, не запущен ли он в виртуальной машине».
Le second dropper inclut des protections anti-débogage (kern.hv_vmm_present, machdep.cpu.brand_string, PT_DENY_ATTACH).
«Стилер по-прежнему стремится выманить у пользователя пароль администратора... MacSync обращается к API... PAM... для проверки учетных данных».
Demande le mot de passe administrateur via une fausse fenêtre système [et] utilise l’API PAM ... pour vérifier le mot de passe.
«MacSync похищает... конфигурации SSH, AWS, Kubernetes и Git».
«Стилер по-прежнему стремится выманить у пользователя пароль администратора... MacSync обращается к API... PAM... для проверки учетных данных».
The infection chain includes “abuse of iCloud Calendar for payload delivery.”
«ссылка вела на публичный календарь iCloud: загрузчик передавал его содержимое в zsh, а команды, скрытые после поля DESCRIPTION, загружали следующий .app-бандл».
401 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
153 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A macOS information stealer delivered through counterfeit AI installation instructions hosted in a published Claude artifact. Users are instructed to paste a curl command into Terminal; the command decodes a download URL pointing to paripassuventures[.]com. Shared Claude and Perplexity conversations also used the same download-path pattern on other compromised sites.
macOS information stealer delivered through AI-themed lures, including artifacts published on official Claude and ChatGPT platforms that redirect users to malicious commands or backup domains. It was identified in eight of twelve analyses of the relevant payloads; the content also associates its delivery with /curl/<64 hex chars> paths.
Listed as a stealer without further technical details or an explicit connection to the ICMacOS operation.
Mentioned as a macOS-focused information stealer for background context; the reference does not describe its capabilities or connect it to the ICMacOS operation.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.