This campaign leverages social engineering via fake macOS utility lures to deliver multiple infostealers targeting sensitive user data. Malicious Terminal commands hosted on public platforms are disguised as legitimate troubleshooting instructions. When run, these commands download and execute infostealers including Macsync, Shub Stealer, and AMOS. These malware variants exfiltrate a range of sensitive data such as browser credentials, cryptocurrency wallets, iCloud data, Keychain entries, and media files. The campaign uses Terminal-based script execution techniques that evade macOS Gatekeeper protections. Persistence is established through LaunchAgents and LaunchDaemons masquerading as legitimate services. Some variants trojanize cryptocurrency wallet applications to maintain access and facilitate credential theft. The adversary behind this campaign is identified as PhantomRaven.

Successful execution of the malicious commands results in the installation of infostealers that exfiltrate highly sensitive user data including browser credentials, cryptocurrency wallets, iCloud data, Keychain entries, and media files. This can lead to credential theft, financial loss, privacy breaches, and unauthorized access to user accounts and assets. The campaign’s ability to bypass Gatekeeper and establish persistence increases the risk of prolonged compromise on affected macOS systems.

No official patch or fix is indicated for this campaign. Mitigation focuses on user awareness to avoid executing untrusted Terminal commands, especially those sourced from unverified blogs or content platforms. Users should verify the authenticity of troubleshooting advice before execution. Employing endpoint security solutions that detect and block known infostealers and monitoring for suspicious persistence mechanisms such as unauthorized LaunchAgents and LaunchDaemons is recommended. Gatekeeper bypass techniques highlight the need for layered security controls beyond default macOS protections.