MacSync: The Evasive macOS Stealer Exploiting ClickFix Lures
Source AlienVault OTX General
Description
MacSync Stealer is a macOS information stealer and remote-access stager delivered through ClickFix social engineering and malvertising campaigns. Operating under a malware-as-a-service model, it employs sophisticated evasion techniques including process daemonization, single-byte XOR obfuscation, and in-memory AppleScript execution to bypass Apple Gatekeeper, XProtect, and EDR solutions. The malware exfiltrates credentials, browser data, cryptocurrency wallets, and SSH keys through fault-tolerant 10MB chunked uploads to command-and-control infrastructure. MacSync targets professionals in software engineering, cryptocurrency, fintech, and corporate environments across North America, Europe, and Asia-Pacific regions, with campaigns impersonating legitimate services like Google Meet, Claude AI, Docker, and TradingView to trick victims into executing malicious Terminal commands.
Impact
Successful infection results in theft of sensitive user data including credentials, browser data, cryptocurrency wallets, and SSH keys. This can lead to unauthorized access to user accounts, financial theft, and further compromise of corporate or personal systems. The malware's evasion techniques make detection and prevention more difficult, increasing the risk of prolonged undetected access and data exfiltration. The targeting of professionals in high-value sectors increases the potential impact on critical infrastructure and financial assets.
Defensive guidance
No official patch or fix is applicable as this is malware delivered via social engineering and user interaction. Mitigation focuses on user education to recognize and avoid ClickFix lures and malicious impersonations of legitimate services. Endpoint protection solutions should be updated and configured to detect behaviors such as process daemonization, AppleScript execution in memory, and suspicious network exfiltration patterns. Network defenses can block known malicious domains associated with MacSync campaigns (e.g., drivinguber.com, newsinweb.com and subdomains). Monitoring for execution of unexpected Terminal commands and restricting execution privileges can reduce risk. Since this is malware-as-a-service, vigilance against phishing and malvertising campaigns is critical. Patch status is not applicable; focus on prevention and detection controls.
MITRE ATT&CK techniques
- T1059.002Command and Scripting Interpreter: AppleScript · Execution (opens in a new tab)
- T1059.004Command and Scripting Interpreter: Unix Shell · Execution (opens in a new tab)
- T1204.002User Execution: Malicious File · Execution (opens in a new tab)
- T1543.001Create or Modify System Process: Launch Agent · Persistence, Privilege Escalation (opens in a new tab)
- T1027Obfuscated Files or Information · Stealth (opens in a new tab)
Indicators of compromise
Domains 4
- drivinguber.com
- newsinweb.com
- asia.newsinweb.com
- usa.newsinweb.com