Do Son 
Architectural flow of the MacSync Mach-O stager | Image: Seqrite APT Team
At a glance
Security researchers at Seqrite APT Team uncovered an evasive malware campaign targeting Apple enterprise users. This newly analyzed threat, known as the MacSync macOS stealer, tricks victims into running malicious commands through deceptive browser prompts. The operators sell the malware under a commercial malware-as-a-service model to various affiliate groups.
| Category | Details |
|---|---|
| Malware Family | MacSync Stealer (associated with Mac.C Stealer) |
| Threat Actor | Unconfirmed syndicate (developer identity “Mentalpositive”) |
| Target or Victims | Enterprise macOS users in tech, Web3, and government sectors |
| Delivery Vector | ClickFix social engineering lures and search malvertising |
| Key Capabilities | In-memory AppleScript execution, credential theft, chunked exfiltration |
| Source | Seqrite APT Team |
Executive Summary
The MacSync macOS stealer evades built-in operating system defenses to extract credentials and crypto assets. Threat actors distribute the lightweight payload through ClickFix social engineering prompts and search malvertising. Security teams must monitor unauthorized terminal executions and inspect unusual background script activity to safeguard endpoints.
Delivery Methods
Threat actors deliver MacSync by abusing human trust rather than exploiting software vulnerabilities. In many instances, attackers deploy search engine malvertising to poison results for popular developer tools. Unsuspecting users seeking applications like Claude AI, Docker Desktop, or Zoom land on compromised websites instead.
Additionally, affiliates route web traffic through traffic distribution systems like Keitaro. The system checks browser user-agent strings to identify the operating system. If the visitor uses Windows, the traffic flows toward info-stealers like LummaC2. Conversely, macOS visitors enter the MacSync distribution funnel.
Once on the lure page, the victim encounters a fake verification error. These lures often mimic Google Meet microphone errors or Cloudflare verification challenges. The page instructs the user to copy a terminal command to fix the issue. When the user pastes this string into their terminal, the payload launches in the background. The detailed findings in the Seqrite threat research report show that this social engineering tactic bypasses Apple Gatekeeper.
Infection Chain Architecture
The initial shell script downloads a native 64-bit Mach-O binary stager. The advisory explains the design. It notes, “Rather than standalone harvesters, the payloads are lightweight 64-bit Mach-O executables that detach silently from terminal sessions, load credential-dumping modules directly into memory, and reliably exfiltrate stolen credentials back to campaign infrastructure.”
Upon launch, the binary detaches from the terminal window using standard system calls. It reparents to process identifier one and redirects standard streams to null devices. Consequently, terminal screens show no suspicious error messages or process outputs.
Furthermore, the binary conceals internal strings using an inlined template engine. It stores server paths and command strings as single-byte XOR constants. At runtime, the stager decrypts these elements into stack buffers.
Next, the stager executes credential harvesting modules. The authors avoid writing scripts to the disk. The report states, “The stager avoids writing credential-dumping scripts to disk.” Instead, the binary streams remote AppleScript commands directly into the system script runner via standard input. This script prompts the user for system passwords and dumps stored keychains, browser databases, SSH keys, and cryptocurrency wallets.
Command-and-Control and Data Exfiltration
The stager establishes communications with remote servers using custom authentication headers. As the report explains, “MacSync Stealer is a family of macOS information stealers and remote-access stagers designed to evade detection and sold commercially under a malware-as-a-service (MaaS) model.” Multiple campaigns maintain independent backend infrastructure. For instance, Microsoft telemetry linked more than 30 unique domains to this activity.
After collecting passwords and wallet files, the malware stages the stolen records in a temporary archive. To transfer large files without triggering network alerts, MacSync splits archives into 10 MB pieces. It uses the native copy utility to carve file slices and uploads each piece sequentially. If an upload fails, the malware applies an adaptive backoff retry algorithm.
Once the remote server confirms receipt, MacSync deletes the temporary archive and status files. In some intrusions, the stager deploys a secondary remote access trojan. The trojan creates persistence within the local LaunchAgents directory by masquerading as legitimate system services.
Targeting and Attribution Analysis
Campaign telemetry shows that attackers focus on regions with dense enterprise macOS adoption. Security records indicate that the United States represents 41.4 percent of detections. Meanwhile, the United Kingdom accounts for 8.2 percent, and Germany represents 6.9 percent. Japan, Canada, and France also face notable attack volumes. High-value targets include software engineers, Web3 developers, and corporate remote workers.
Attribution remains unconfirmed. Researchers identified Russian-language comments in development artifacts. Furthermore, historical ties link the code to a developer handle known as “Mentalpositive.” However, these indicators do not definitively connect the operation to a specific cybercrime syndicate.
Defense and Detection Guidance
Organizations must adjust endpoint defenses to stop the MacSync macOS stealer. Defenders cannot rely exclusively on static file signatures. Instead, teams should implement behavioral monitoring across all macOS endpoints.
Recommended Security Controls
- Monitor process telemetry for terminal sessions that spawn detached background processes.
- Detect osascript instances receiving piped code directly from network utilities.
- Inspect the LaunchAgents directory for unverified background startup entries.
- Block network connections to known infrastructure endpoints and suspicious domains.
- Train staff to avoid running copied terminal scripts from untrusted web pages.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
