MacSync Stealer Hijacks Telegram Sessions and Crypto Wallets on macOS

Researchers detailed a macOS malware campaign using ClickFix-style malvertising and fake Claude download lures to deploy MacSync Stealer, an infostealer built to harvest trusted local artifacts rather than rely only on stolen passwords. Victims were redirected from Google ads to spoofed shared Claude chat pages, then tricked into running a Base64-obfuscated shell command that launched multi-stage shell and AppleScript payloads. The malware collected Keychain data, browser credentials, password-manager and wallet extension data, Telegram files, shell histories, cloud keys, Apple Notes content, and selected documents, while also prompting for the macOS password and Full Disk Access; if blocked, it added persistence through ~/.zshrc so it could retry on the next Terminal launch.

The theft enabled direct account and asset compromise. SlowMist found the malware could restore stolen Telegram Desktop and Telegram for macOS session files on another Mac without triggering phone verification or Telegram two-step verification because it reused an already authorized local session. It also targeted 16 wallet applications and 223 wallet-related browser extension IDs, harvesting candidate passwords from multiple sources to decrypt wallet data offline. In a more active phase, the malware removed legitimate Ledger and Trezor apps and replaced them with malicious WebView loaders that displayed attacker-controlled phishing pages to capture recovery phrases. Investigators linked the campaign to multiple malicious domains and Google ad campaign IDs, and published IOCs including IP addresses, URLs, and SHA-256 hashes.