A new version of the MacSync macOS stealer targets crypto enthusiasts and developers
A detailed technical analysis examines the evolution of MacSync, a macOS stealer-as-a-service initially known as Mac.c, which targets cryptocurrency enthusiasts and developers. The malware has undergone significant changes, replacing AppleScript-based droppers with binary executable files written in Objective-C and Swift. The infection chain utilizes malicious DMG images and employs iCloud infrastructure for payload delivery. MacSync collects extensive data including browser credentials, cryptocurrency wallets, Telegram data, SSH configurations, and keychain files. The stealer incorporates novel techniques like PAM API for password verification and features a backdoor module for persistent access. Distribution occurs through social engineering, fake applications, and cracked software disguised as legitimate crypto wallets like the nonexistent Toria wallet, promoted through dedicated websites and social media channels.
AI Analysis
Technical Summary
MacSync is a macOS stealer-as-a-service that targets cryptocurrency users and developers by harvesting sensitive data such as browser credentials, cryptocurrency wallets, Telegram data, SSH configurations, and keychain files. The malware has transitioned from AppleScript-based droppers to binary executables written in Objective-C and Swift. Its infection chain involves malicious DMG images and leverages iCloud infrastructure for payload delivery. MacSync incorporates advanced techniques including the use of the PAM API for password verification and a backdoor module to maintain persistent access. Distribution methods include social engineering tactics, fake applications, and cracked software disguised as legitimate cryptocurrency wallets, notably the fictitious Toria wallet, promoted through dedicated websites and social media channels.
Potential Impact
The malware compromises sensitive user data including browser credentials, cryptocurrency wallets, Telegram messaging data, SSH configurations, and macOS keychain files, potentially leading to theft of cryptocurrencies, unauthorized access to user accounts, and persistent system compromise via a backdoor. The use of iCloud infrastructure for payload delivery and advanced techniques like PAM API exploitation increase the stealth and persistence of the threat.
Mitigation Recommendations
No official patch or vendor advisory is available for this malware. Mitigation should focus on user awareness to avoid social engineering, fake applications, and cracked software, especially those purporting to be cryptocurrency wallets. Users should verify software sources and avoid installing software from untrusted websites or social media promotions. Employ endpoint protection solutions capable of detecting macOS malware and monitor for suspicious DMG files and unexpected network activity related to iCloud services.
Indicators of Compromise
- hash: 26a0f7cdb9f7dc5ace9a40af825b1538
- hash: 2d69812584269699fade26622e6490c5
- hash: 7df1049cbd56c0bfa4a3364a379b4c2c
- hash: 9f15fe9c4415cd668334339f705b94d8
- hash: fb90887592655a8c989e443c640167aa
- hash: 6791dad263cac6d63ebba6a4b57e7d71
- hash: 3ded1d71a822b53b12c3b67bcaf633f5
- hash: 781ce50001d4b449600afa347c9b0208
- hash: 8e84b01d5ac9624f0b181ade0e737193
- hash: 980e2134679bc0c609f7659882883d77
- hash: 4203ec932bfcc0907f91732440d6d997
- hash: eb760d5c88f13f7ee0f8f86ba3407123
- hash: f9f70096aabb4d22a6657014f4853a53
- hash: 3deeed48fd38f22e369f5c3092bd68a1
- hash: f97d24212fa6a21be0c4d211e10f044c
- hash: 00d12d842596bf5ee1805effb4571d30
- hash: 9a0043d900a9ac78c886c59c9a328fd0
- hash: 7212229c85852c3bffaf9740002b2f39
- hash: c53d0ea45dbc622afb7f16ea3eec78bc
- hash: fc3ba5ed282d77127efd0b0f2403531b
- hash: 8dc8561349d144d4661bc66f2ec49f9f
- url: https://warpcast.asia/Toria.dmg
- url: https://streamyard.appstore.com.mx/installer.sh
- url: https://slack.apple03cloudstore.com/installer.sh
- url: https://toria.apple03cloudstore.com/
- url: https://waaako.appstore.com.mx/installer.sh
- url: https://toria.apple03cloudstore.com/e3c1a6b00bc31e14/stage2.enc
- url: https://docsend.appstore.com.mx/dcc737d157ef4271/stage2.enc
- url: https://docsend.appstore.com.mx/dcc737d157ef4271/CoreUpdate.pkg.enc
- url: https://docsend.appstore.com.mx/dcc737d157ef4271/Helper.pkg.enc
- url: https://docsend.appstore.com.mx
- url: https://toria.apple03cloudstore.com
- hash: 09425f72de8bba18893dcd6f04115891
- hash: 3a1af2b397c6958e6c3ba3c75912d60e
- hash: 8d371f8a7a6dcc2655544ae13cbca03d
- hash: 3744f975113dfc552df982dcae699f9154a448e05a743bdfb641a463352bc13a
- hash: b8b4b88205a8f594b95a841bc37342898f34cad8a5a9e4a22ce69a31a1208650
- hash: cb09ff86cabde4f8cee2d3cdec370c623bfa6c2b72ae9750fc9a7b299c65d7ca
- hash: ff3ab9ef841630364818396f62e696b72aed162cf0b895b6643ef25dad79b51d
- hash: ff664112d3215c5d184689fc836e0dc6c1a47e42c34e70b2c3d356864bc4cb4c
- domain: docsend.appstore.com.mx
- domain: slack.apple03cloudstore.com
- domain: streamyard.appstore.com.mx
- domain: toria.apple03cloudstore.com
- domain: waaako.appstore.com.mx
A new version of the MacSync macOS stealer targets crypto enthusiasts and developers
Description
A detailed technical analysis examines the evolution of MacSync, a macOS stealer-as-a-service initially known as Mac.c, which targets cryptocurrency enthusiasts and developers. The malware has undergone significant changes, replacing AppleScript-based droppers with binary executable files written in Objective-C and Swift. The infection chain utilizes malicious DMG images and employs iCloud infrastructure for payload delivery. MacSync collects extensive data including browser credentials, cryptocurrency wallets, Telegram data, SSH configurations, and keychain files. The stealer incorporates novel techniques like PAM API for password verification and features a backdoor module for persistent access. Distribution occurs through social engineering, fake applications, and cracked software disguised as legitimate crypto wallets like the nonexistent Toria wallet, promoted through dedicated websites and social media channels.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
MacSync is a macOS stealer-as-a-service that targets cryptocurrency users and developers by harvesting sensitive data such as browser credentials, cryptocurrency wallets, Telegram data, SSH configurations, and keychain files. The malware has transitioned from AppleScript-based droppers to binary executables written in Objective-C and Swift. Its infection chain involves malicious DMG images and leverages iCloud infrastructure for payload delivery. MacSync incorporates advanced techniques including the use of the PAM API for password verification and a backdoor module to maintain persistent access. Distribution methods include social engineering tactics, fake applications, and cracked software disguised as legitimate cryptocurrency wallets, notably the fictitious Toria wallet, promoted through dedicated websites and social media channels.
Potential Impact
The malware compromises sensitive user data including browser credentials, cryptocurrency wallets, Telegram messaging data, SSH configurations, and macOS keychain files, potentially leading to theft of cryptocurrencies, unauthorized access to user accounts, and persistent system compromise via a backdoor. The use of iCloud infrastructure for payload delivery and advanced techniques like PAM API exploitation increase the stealth and persistence of the threat.
Defensive Guidance
No official patch or vendor advisory is available for this malware. Mitigation should focus on user awareness to avoid social engineering, fake applications, and cracked software, especially those purporting to be cryptocurrency wallets. Users should verify software sources and avoid installing software from untrusted websites or social media promotions. Employ endpoint protection solutions capable of detecting macOS malware and monitor for suspicious DMG files and unexpected network activity related to iCloud services.
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://securelist.com/macsync-new-version/121383/"]
- Pulse Id
- 6ab5176a22ab1049d0969c4a
Indicators of Compromise
Hash
| Value | Description | Copy |
|---|---|---|
hash26a0f7cdb9f7dc5ace9a40af825b1538 | — | |
hash2d69812584269699fade26622e6490c5 | — | |
hash7df1049cbd56c0bfa4a3364a379b4c2c | — | |
hash9f15fe9c4415cd668334339f705b94d8 | — | |
hashfb90887592655a8c989e443c640167aa | — | |
hash6791dad263cac6d63ebba6a4b57e7d71 | — | |
hash3ded1d71a822b53b12c3b67bcaf633f5 | — | |
hash781ce50001d4b449600afa347c9b0208 | — | |
hash8e84b01d5ac9624f0b181ade0e737193 | — | |
hash980e2134679bc0c609f7659882883d77 | — | |
hash4203ec932bfcc0907f91732440d6d997 | — | |
hasheb760d5c88f13f7ee0f8f86ba3407123 | — | |
hashf9f70096aabb4d22a6657014f4853a53 | — | |
hash3deeed48fd38f22e369f5c3092bd68a1 | — | |
hashf97d24212fa6a21be0c4d211e10f044c | — | |
hash00d12d842596bf5ee1805effb4571d30 | — | |
hash9a0043d900a9ac78c886c59c9a328fd0 | — | |
hash7212229c85852c3bffaf9740002b2f39 | — | |
hashc53d0ea45dbc622afb7f16ea3eec78bc | — | |
hashfc3ba5ed282d77127efd0b0f2403531b | — | |
hash8dc8561349d144d4661bc66f2ec49f9f | — | |
hash09425f72de8bba18893dcd6f04115891 | — | |
hash3a1af2b397c6958e6c3ba3c75912d60e | — | |
hash8d371f8a7a6dcc2655544ae13cbca03d | — | |
hash3744f975113dfc552df982dcae699f9154a448e05a743bdfb641a463352bc13a | — | |
hashb8b4b88205a8f594b95a841bc37342898f34cad8a5a9e4a22ce69a31a1208650 | — | |
hashcb09ff86cabde4f8cee2d3cdec370c623bfa6c2b72ae9750fc9a7b299c65d7ca | — | |
hashff3ab9ef841630364818396f62e696b72aed162cf0b895b6643ef25dad79b51d | — | |
hashff664112d3215c5d184689fc836e0dc6c1a47e42c34e70b2c3d356864bc4cb4c | — |
Url
| Value | Description | Copy |
|---|---|---|
urlhttps://warpcast.asia/Toria.dmg | — | |
urlhttps://streamyard.appstore.com.mx/installer.sh | — | |
urlhttps://slack.apple03cloudstore.com/installer.sh | — | |
urlhttps://toria.apple03cloudstore.com/ | — | |
urlhttps://waaako.appstore.com.mx/installer.sh | — | |
urlhttps://toria.apple03cloudstore.com/e3c1a6b00bc31e14/stage2.enc | — | |
urlhttps://docsend.appstore.com.mx/dcc737d157ef4271/stage2.enc | — | |
urlhttps://docsend.appstore.com.mx/dcc737d157ef4271/CoreUpdate.pkg.enc | — | |
urlhttps://docsend.appstore.com.mx/dcc737d157ef4271/Helper.pkg.enc | — | |
urlhttps://docsend.appstore.com.mx | — | |
urlhttps://toria.apple03cloudstore.com | — |
Domain
| Value | Description | Copy |
|---|---|---|
domaindocsend.appstore.com.mx | — | |
domainslack.apple03cloudstore.com | — | |
domainstreamyard.appstore.com.mx | — | |
domaintoria.apple03cloudstore.com | — | |
domainwaaako.appstore.com.mx | — |
Threat ID: 6ab57aedf7a7c54106bff432
Added to database: 09/24/2026, 19:33:01 UTC
Last enriched: 09/24/2026, 19:48:17 UTC
Last updated: 09/25/2026, 01:52:11 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.