CampaignPublished 21 Jan 2026

Inside MacSync's Script-Driven Stealer and Hardware Wallet App Trojanization

Source AlienVault OTX General

Description

MacSync is a sophisticated macOS infostealer that targets cryptocurrency users. It is delivered through a phishing lure disguised as a cloud storage installer, tricking users into executing a malicious Terminal command. The malware employs a multi-stage infection process, using a script-based approach to harvest browser credentials, cryptocurrency wallet data, and sensitive files. A key feature of MacSync is its ability to trojanize popular Electron-based cryptocurrency applications like Ledger and Trezor, enabling long-term phishing and data exfiltration. The malware's infrastructure includes multiple rotating C2 domains and clone sites, indicating an ongoing and evolving campaign. MacSync's focus on cryptocurrency-related data and its stealthy, script-based execution make it particularly dangerous for macOS users in the crypto community.

Impact

For European organizations and users, MacSync poses a significant threat to the confidentiality and integrity of cryptocurrency assets and sensitive data on macOS devices. The trojanization of widely used hardware wallet applications like Ledger and Trezor could lead to prolonged undetected theft of private keys and credentials, resulting in direct financial losses. Organizations involved in cryptocurrency trading, fintech, or blockchain development are at heightened risk. The malware’s ability to harvest browser credentials and files may also expose corporate secrets and personal information, potentially leading to identity theft or further targeted attacks. The phishing delivery method exploits user trust and can bypass standard endpoint protections if users execute the malicious commands. Given the increasing adoption of cryptocurrency in Europe, especially in countries with active crypto communities, the threat could disrupt business operations and erode trust in digital asset management. The rotating C2 infrastructure indicates a persistent campaign that may evolve to evade detection, increasing the risk of widespread infections if not mitigated promptly.

Defensive guidance

European organizations should implement targeted defenses beyond generic advice: 1) Educate macOS users, especially those handling cryptocurrency, about the risks of executing unsolicited Terminal commands and phishing lures disguised as legitimate installers. 2) Deploy endpoint detection and response (EDR) solutions capable of monitoring script execution and detecting anomalous behavior related to Electron app tampering. 3) Implement application whitelisting and restrict execution of unsigned or untrusted scripts and binaries on macOS endpoints. 4) Monitor network traffic for connections to known malicious domains associated with MacSync’s C2 infrastructure and block them at the firewall or DNS level. 5) Regularly audit and verify the integrity of cryptocurrency wallet applications to detect trojanization or unauthorized modifications. 6) Encourage use of hardware wallets with strong firmware verification and multi-factor authentication where possible. 7) Maintain updated backups of critical data and ensure incident response plans include procedures for macOS-specific malware. 8) Collaborate with threat intelligence sharing groups to stay informed about evolving indicators of compromise related to MacSync.

Indicators of compromise

Domains 21

foo-bar.fish
manifest.in
xmlpull.org
app-webview.dreamplug.in
merchant-app-prod.dreamplug.in
webview-prod.dreamplug.in
crosoftonline.com
jmpbowl.coupons
jmpbowl.fun
jmpbowl.shop

Hashes 6

1fe278fd06404638a50bf7b126f9075c
5190ef1733183a0dc63fb623357f56d6
70c0ee60591fed92b387ddd77122f3f5e88ae946efdd5eef8aa654cf156ed321
89a229f9a73cffc67089f388c6c12f3f9d80e7ae2c32745cd5212421a89c3e50
c99dea85f0ef8d3e2f3771c8ebd02d7dee0d90efc5c8392e5c266a59640a4206
ec6bc84be18ce4cb55fb915370c00f2a836ffefc65c6b728efb8d2d28036e376

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 21 Jan 2026, 23:20 UTC

MITRE ATT&CK techniques16 from threat tags

Technical details

Indicators of compromise

Domains 21

Hashes 6

Community reviews

Related threats