MacSync is a sophisticated six-stage macOS attack chain triggered when users searching for Claude installation instructions are redirected via malicious Google Ads to weaponized claude.ai/share conversation pages posing as Apple Support guides. Victims execute a curl command that installs a multi-component malware suite including a zsh loader, server-side AppleScript stealer, native Mach-O RAT, TCC permission-stealing helper, and cryptocurrency wallet trojans. The operation steals extensive credentials including browser data, keychain secrets, confirmed passwords, Telegram sessions, SSH keys, and cloud credentials, with a particular emphasis on cryptocurrency wallets (60 browser extensions, 21 desktop apps, and 3 trojanized hardware wallet companions). Persistence is achieved through LaunchAgents masquerading as legitimate updaters. The attack infrastructure uses Cloudflare-fronted delivery domains and dedicated RAT command-and-control servers. The vulnerability affects macOS versions prior to 5.8.0.24 and is rated critical with a CVSS 3.1 score of 9.8.

Successful exploitation results in full compromise of affected macOS systems, including theft of browser credentials, keychain secrets, confirmed account passwords, Telegram sessions, SSH keys, and cloud credentials. The attack heavily targets cryptocurrency assets by phishing recovery phrases from numerous wallet browser extensions, desktop apps, and hardware wallet companions. The malware achieves persistence and stealth, enabling ongoing data exfiltration and remote access via a native Mach-O RAT and other components. This leads to high confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, users should avoid executing untrusted curl commands, especially those sourced from unverified websites or ads. Exercise caution when following installation instructions from unofficial sources. Monitor for suspicious LaunchAgents and network connections to known malicious infrastructure domains (agenticsora[.]com, malwareaudit[.]com) and IP addresses (103.216.221.95, 85.206.161.241:8443). Employ endpoint detection tools capable of identifying Mach-O RATs and TCC permission abuse. Follow vendor advisories for updates on patches or official mitigations.