credential-stealer-activitypersistence-methodremote-access-implantloader-delivery-mechanism

MacSync macOS Stealer Adds Backdoor and iCloud-Based Delivery

Malware Intelligence · 11 sources · Updated 1mo ago · First seen Sep 24, 2026

A new MacSync malware-as-a-service campaign targets macOS cryptocurrency users and developers with trojanized DMG applications, binary loaders, and droppers. Originally advertised as Mac.c in 2025, the stealer has progressed from AppleScript payloads to Swift and Objective-C binaries and now uses Apple iCloud Calendar and file-hosting infrastructure to retrieve subsequent payloads.

MacSync collects browser and cryptocurrency-wallet data, credentials, Keychain-related material, Telegram data, cloud and developer configuration files, system details, and shell histories. It persists through LaunchAgents, modified ZSH settings, global Git hooks, Login Items, and restoration scripts while suppressing user notifications; its backdoor can receive C2 tasks to install browser extensions, replace Ledger wallet software, repeat collection, and potentially intercept browser traffic.

Hunt this familyPull IOCs and campaign context straight into your stack.

Get the IOCs

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · 2025 – Sep 2026

Reported Sep 25, 20261mo ago
MacSync report publishes new persistence details and detection indicators
A Gurucul threat-research report documented MacSync persistence through LaunchAgents and Git hooks in addition to ZSHRC modification, along with AES/ECDH Curve25519 use, anti-debugging, and in-memory execution. The report published 21 MD5 hashes and malicious URL indicators tied to MacSync infrastructure and payload delivery.
MacSync under the microscope: new delivery methods and a new payload | Community Portal | Gurucul
Reported Sep 21, 20262mo ago
MacSync used ~/.zshrc modification for Terminal-session persistence
A Huntress-documented MacSync Stealer/RAT intrusion temporarily modified the victim's ~/.zshrc so that a Base64-wrapped curl | zsh command would run when the victim next opened an interactive zsh Terminal session. The exact command was not published.
The .zshrc.zwc You Forgot to Check | dfir.ch
Sep 2026
Updated MacSync infection chain observed in the wild
Researchers first observed an updated MacSync campaign using malicious DMG application bundles, binary loaders and droppers, and iCloud Calendar and file-hosting infrastructure to deliver later-stage payloads. The campaign included Toria cryptocurrency-wallet impersonation and deployed an infostealer and Objective-C backdoor with extensive persistence and data-theft capabilities.
A new version of the MacSync macOS stealer targets crypto enthusiasts and developers | Securelist
2025
MacSync advertised as Mac.c on dark-web forums
The macOS information and cryptocurrency stealer was advertised under the name Mac.c on dark-web forums before its developers renamed it MacSync.
A new version of the MacSync macOS stealer targets crypto enthusiasts and developers | Securelist

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Malware

1 linked

MacSync

Affected products

1 linked

Macos

Observables

56 linked

MD5 hash••••••••••••••••••••••••••••••••URLhttps://••••••.•••/•••••Domain••••••••.comSHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

MD5 hash••••••••••••••••••••••••••••••••URLhttps://••••••••••.•••/•••••Domain••••••••••••.comSHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

+48

Indicator values are masked on this page. View all 56 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.

Hunt This Malware

Source coverage

Sources

11 references tracked. Mallory keeps watching after this page renders.

XakepNews · Sep 30, 2026

Новая версия стилера MacSync доставляет полезную нагрузку через iCloud - ХакерOpen source ↗

Gurucul Threat ResearchNews · Sep 25, 2026

MacSync under the microscope: new delivery methods and a new payload | Community Portal | GuruculOpen source ↗

Help Net SecurityNews · Sep 25, 2026

MacSync info-stealing malware hides malicious commands in an iCloud calendar - Help Net SecurityOpen source ↗

Cyber Security NewsNews · Sep 25, 2026

New MacSync Malware Turns macOS Apps Into Tools for Crypto and Password TheftOpen source ↗

3 additional sources from 24-09-2026 to 24-09-2026

Securelist RuNews · Sep 24, 2026

Новая версия macOS-стилера MacSync атакует криптолюбителей и разработчиков | SecurelistOpen source ↗

SecurelistNews · Sep 24, 2026

A new version of the MacSync macOS stealer targets crypto enthusiasts and developers | SecurelistOpen source ↗

Dfir BlogNews · Sep 21, 2026

The .zshrc.zwc You Forgot to Check | dfir.chOpen source ↗

Theevilbit GithubNews · Mar 14, 2021

Beyond the good ol' LaunchAgents - 1 - shell startup files · theevilbit blogOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

MacSync macOS Stealer Adds Backdoor and iCloud-Based Delivery

How this story unfolded

MacSync report publishes new persistence details and detection indicators

MacSync used ~/.zshrc modification for Terminal-session persistence

Updated MacSync infection chain observed in the wild

MacSync advertised as Mac.c on dark-web forums

Related entities

Malware

Affected products

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

MacSync macOS Infostealer Using ClickFix-Style Terminal Paste Lure to Steal Cryptocurrency Data

MacSync macOS Stealer Uses ClickFix Lures to Exfiltrate Credentials

MacSync Malware Used Fake Claude Setup to Steal macOS Credentials and Crypto Seeds

MacSync macOS Stealer Adds Backdoor and iCloud-Based Delivery

How this story unfolded

MacSync report publishes new persistence details and detection indicators

MacSync used ~/.zshrc modification for Terminal-session persistence

Updated MacSync infection chain observed in the wild

MacSync advertised as Mac.c on dark-web forums

Related entities

Malware

Affected products

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

MacSync macOS Infostealer Using ClickFix-Style Terminal Paste Lure to Steal Cryptocurrency Data

MacSync macOS Stealer Uses ClickFix Lures to Exfiltrate Credentials

MacSync Malware Used Fake Claude Setup to Steal macOS Credentials and Crypto Seeds