Malicious Ad for Homebrew Leads to MacSync Stealer, (Fri, May 1st)
Source SANS ISC Handlers Diary
0
Description
Introduction
Impact
Successful execution of the malicious script results in the compromise of macOS hosts, with MacSync Stealer collecting and exfiltrating sensitive information to an attacker-controlled server. The malware gains elevated permissions by prompting for user passwords and access to system components, potentially leading to data theft and further system compromise. The campaign exploits user trust in Homebrew and social engineering via search ads.
Defensive guidance
Users should avoid executing scripts from untrusted sources, especially those obtained via search ads or unfamiliar websites. Verify the authenticity of Homebrew downloads by using official channels only.
Summary
This threat involves a malvertising campaign targeting macOS users by presenting a fake Homebrew package manager page. Victims are encouraged to copy and paste a script into their terminal, which executes MacSync Stealer malware. The malware collects host information, saves it temporarily to /tmp/osalogging.zip, and sends this data to a remote command and control server. The infection process includes multiple user prompts requesting passwords and permissions, facilitating the malware's operation. The malicious ad and fake site URLs are documented, along with file hashes for the scripts involved. No cloud service is implicated, and no known exploits in the wild beyond this campaign are reported.