Loading story…
MacSync, a malware-as-a-service macOS stealer and remote-access stager, is being distributed through ClickFix social engineering, SEO poisoning, malvertising, compromised websites, and fake software or AI installers that prompt victims to run Terminal commands. Its native 64-bit Mach-O stager daemonizes itself, XOR-decrypts its configuration, downloads an AppleScript stealer from command-and-control (C2) infrastructure, and executes it in memory through osascript.
The malware targets Keychain records, browser credentials and cookies, SSH keys, messaging sessions, cloud credentials, cryptocurrency wallets, and sensitive files. It archives collected data and exfiltrates it in 10 MB HTTP PUT chunks before deleting local staging artifacts; analyzed samples used drivinguber.com as primary C2 infrastructure and newsinweb.com-derived hosts as fallbacks. Public reporting associates MacSync with the earlier Mac.C Stealer and the developer identity “Mentalpositive,” though Russian-language artifacts do not substantiate attribution to a particular actor, syndicate, or affiliate campaign.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Telemetry for August 2026 identified the United States as the largest source of MacSync detections, followed by the United Kingdom, Germany, Japan, Canada, France, Singapore, Australia, India, the Netherlands, and Nordic countries.
MacSync emerged as a malware-as-a-service family of macOS information stealers and remote-access stagers. Public reporting linked it to the earlier Mac.C Stealer and the developer identity “Mentalpositive,” while noting that Russian-language artifacts do not establish definitive attribution.
MacSync operators were reported to use fraudulent Claude, ChatGPT, and developer-tool download pages promoted through manipulated or sponsored search results to deliver ClickFix Terminal-command lures. The report also detailed credential and wallet-data theft, possible LaunchAgent persistence and remote access, and a helper that may request screen-recording permission.
Analysis documented MacSync delivery through ClickFix lures, SEO poisoning, malvertising, compromised sites, and fake installers that induce victims to execute Terminal commands. The analyzed stager used drivinguber.com as primary C2, newsinweb.com-derived fallback hosts, retrieved an AppleScript stealer for in-memory osascript execution, and exfiltrated collected data in HTTP PUT chunks.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcemalware.news
Open sourceseqrite.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported a **macOS infostealer** dubbed **MacSync** being distributed as a low-cost **Malware-as-a-Service (MaaS)**, primarily targeting **cryptocurrency users** via a *ClickFix*-style social engineering lure. The campaign uses phishing infrastructure (including domains mimicking **Microsoft login** pages) to redirect victims to a fake macOS *cloud storage installer* site that instructs users to “install” by copying and pasting a **single Terminal command**. This approach relies on user execution rather than a signed app package, allowing the infection chain to **bypass macOS protections** such as **Gatekeeper** and **notarization**. Technical analysis describes a **script-based, multi-stage** infection chain: the pasted one-liner fetches a remote script that installs a **daemonized Zsh loader** which detaches from the Terminal session and runs in the background, then retrieves additional payloads (including **AppleScript**) to perform data theft. Beyond credential and wallet data harvesting, reporting indicates MacSync can **persist and expand impact** by **trojanizing Electron-based cryptocurrency applications** (e.g., *Ledger Live* and *Trezor Suite*) by overwriting components to present convincing phishing flows designed to capture **PINs** and **recovery phrases**, potentially triggering theft well after the initial compromise.
Jun 29, 2026
Huntress reported a macOS intrusion in which a user searching Google for Claude installation instructions clicked a sponsored result that led to a weaponized public Claude share on `claude.ai`, ultimately triggering installation of **MacSync**, a stealer and remote-access trojan. The infection chain relied on a pasted command executed by the victim, then fetched a server-side AppleScript payload, prompted for **Full Disk Access**, and harvested browser data, keychain contents, wallet information, and other credentials before installing a persistent Mach-O RAT. Investigators said the malware also deployed a helper component to obtain **Screen Recording** permission, expanding the attacker’s visibility on the host. The campaign used delivery domains `agenticsora[.]com` and `malwareaudit[.]com`, a RAT command-and-control endpoint at `85.206.161[.]241:8443`, and seed-phrase collection domains `main.sdhomeinspectors[.]com` and `main.southcarolinacounselor[.]com`. Huntress found that if cryptocurrency wallet applications including **Ledger Live**, **Ledger Wallet**, or **Trezor Suite** were installed, MacSync trojanized those apps in place to phish recovery seed phrases and exfiltrate them to attacker-controlled infrastructure. The researchers assessed that MacSync shares strong lineage with **AMOS/Atomic Stealer** tradecraft, including Russian-language developer artifacts, but goes further by combining credential theft with persistent remote access, screen capture, and wallet-app rewriting.
Aug 3, 2026
Researchers detailed a macOS malware campaign using **ClickFix-style malvertising** and fake Claude download lures to deploy **MacSync Stealer**, an infostealer built to harvest trusted local artifacts rather than rely only on stolen passwords. Victims were redirected from Google ads to spoofed shared Claude chat pages, then tricked into running a Base64-obfuscated shell command that launched multi-stage shell and AppleScript payloads. The malware collected Keychain data, browser credentials, password-manager and wallet extension data, Telegram files, shell histories, cloud keys, Apple Notes content, and selected documents, while also prompting for the macOS password and **Full Disk Access**; if blocked, it added persistence through `~/.zshrc` so it could retry on the next Terminal launch. The theft enabled direct account and asset compromise. SlowMist found the malware could restore stolen **Telegram Desktop** and **Telegram for macOS** session files on another Mac without triggering phone verification or Telegram two-step verification because it reused an already authorized local session. It also targeted **16 wallet applications** and **223 wallet-related browser extension IDs**, harvesting candidate passwords from multiple sources to decrypt wallet data offline. In a more active phase, the malware removed legitimate **Ledger** and **Trezor** apps and replaced them with malicious WebView loaders that displayed attacker-controlled phishing pages to capture recovery phrases. Investigators linked the campaign to multiple malicious domains and Google ad campaign IDs, and published IOCs including IP addresses, URLs, and SHA-256 hashes.
Jul 17, 2026