A new version of the MacSync macOS stealer targets crypto enthusiasts and developers

A detailed technical analysis examines the evolution of MacSync, a macOS stealer-as-a-service initially known as Mac.c, which targets cryptocurrency enthusiasts and developers. The malware has undergone significant changes, replacing AppleScript-based droppers with binary executable files written in Objective-C and Swift. The infection chain utilizes malicious DMG images and employs iCloud infrastructure for payload delivery. MacSync collects extensive data including browser credentials, cryptocurrency wallets, Telegram data, SSH configurations, and keychain files. The stealer incorporates novel techniques like PAM API for password verification and features a backdoor module for persistent access. Distribution occurs through social engineering, fake applications, and cracked software disguised as legitimate crypto wallets like the nonexistent Toria wallet, promoted through dedicated websites and social media channels.

• Inside ICMacOS: From an Infostealer to a Persistent RATMalware2026-10-27
• Inside Phexia: A macOS malware delivered through ClickFixMalware2026-11-05
• North Korea's Crypto Heists Start on the Open InternetMalware2026-10-31
• September 2026 Infostealer Trend ReportMalware2026-10-28
• Case of AgentTesla Malware Distribution Disguised as a Business Proposal EmailMalware2026-10-14