Active threat familymacOSCredential theft
Malware Intelligence

MacSync Stealer

MacSync is a macOS infostealer assessed to be developed by a Russian-speaking actor. It is distributed through multi-stage ClickFix campaigns that use shared AI chat conversations; the main payload runs with osascript and leaves no trace on disk.

Activity map

A shared chat appearing in search results gives the user a Terminal command as a "fix".

Zscaler

Activity mapUser pastesNo trace on diskPackagingExfiltrationShared chatSearch resultTerminalcurl | osascriptosascript3-stage AppleScriptMacSync StealerInfostealer~/.zshrccurl lineData collection9 targetsLog archiveC2 server
Malicious payloadMacSync Stealer · Infostealer

MacSync is a macOS infostealer assessed to be developed by a Russian-speaking actor. It is distributed through multi-stage ClickFix campaigns that use shared AI chat conversations; the main payload runs with osascript and leaves no trace on disk.

Environment information

  • Operating system
  • Hardware
  • IP and location
  • Installed software
  • Desktop files

Credentials and application data

  • Saved passwords
  • Session cookies
  • Autofill
  • Saved cards
  • Keychain
  • MetaMask
  • Phantom
  • Exodus
  • Electrum
  • Ledger Live
Dark Radar infection records
60,885
Latest infection record
29 October 2026
Malware type
Infostealer
First seen
2025
01

Overview

It targets developers and technical users: collecting cloud keys and shell history creates a risk of direct access to corporate cloud environments.

Ranks 20 of 52 families in Dark Radar data, with 60,885 infection records.

Other names: MacSync

02

Origin and evolution

  1. 2026A ClickFix campaign using shared chat links was documented.Zscaler
03

Technical profile

Malware typeInfostealer
Target operating systemmacOS
Primary purposeKeychain, wallet and cloud key theft
Threat categoryCredential theft
Programming languageAppleScript (multi-stage)
Distribution modelUnknown
First seen2025
Infected systemsmacOS 100%
Public source confidenceMedium
04

Targeted applications

9 applications5 categories
05

Data collection

Credentials

  • Browser passwords93%Verified
  • Session cookies100%Verified
  • Refreshing expired sessions—
  • Autofill3.5%Verified
  • macOS KeychainVerified
  • 2FA and password managers—

Financial

  • Saved cards25%Dark Radar observation
  • Desktop crypto walletsVerified
  • Wallet extensionsVerified
  • Clipboard address replacement—

System

  • File collectionVerified
  • Screenshot—
  • System inventory100%Dark Radar observation

Behavior

  • Additional payload downloadVerified
  • PersistenceVerified
  • Anti-analysis—
06

File system

User folder (~)
File details are in Dark Radar IntelligenceOpen in Intelligence
07

System components

  • Full Disk Access permission is requested
  • Shell configuration
08

How it works

  1. 1Infection

    • A shared AI chat tells the user to paste a command into Terminal (ClickFix).

    Breaking point: Email attachments, sponsored ad links and unlicensed software downloads are blocked at the email and web gateway.

  2. 2Execution and evasion

    • A three-stage AppleScript chain runs in memory with osascript.
    T1204.004User Execution: Malicious Copy and PasteT1059.002AppleScriptT1059.004Unix Shell

    Breaking point: Only signed and notarized applications are allowed; processes requesting passwords through osascript are monitored.

  3. 3Discovery

    • The user is asked for Full Disk Access permission.
    Dark Radar observation

    Infected systems: macOS 100%.

    Breaking point: Bulk system and security software queries from a short-lived process trigger an EDR alert.

  4. 4Data collection

    • Keychain, browsers, wallets, cloud keys, shell history and documents.
    Dark Radar observation

    Data found in the latest 200 logs: password file 93%, cookies 100%, autofill 3.5%, cards 25%, wallets 1%.

    T1056.002GUI Input CaptureT1555.001KeychainT1555.003Credentials from Web BrowsersT1539Steal Web Session CookieT1552.001Credentials In FilesT1005Data from Local SystemT1560Archive Collected Data

    Breaking point: A process other than the browser reading browser profile files is blocked or triggers an alert.

  5. 5Exfiltration and C2

    • Data is compressed and sent in 10 MB chunks with HTTP PUT.
    T1071.001Web ProtocolsT1041Exfiltration Over C2 Channel

    Breaking point: Traffic to newly registered domains, direct IP addresses and non-standard ports is blocked.

  6. 6Persistence and aftermath

    • Persistence is achieved by adding a curl command to the ~/.zshrc file.
    • A trojanized application can be dropped for hardware wallet users.
    T1546.004Unix Shell Configuration Modification

    Breaking point: When an infection is confirmed, all sessions and access tokens on the device are revoked.

09

Network communication

This section is in Dark Radar IntelligenceOpen in Intelligence
10

MITRE ATT&CK

Execution
Persistence
Credential Access
Collection
Command and Control
Exfiltration
11

IOCs and detection

This section is in Dark Radar IntelligenceOpen in Intelligence
12

Risk and impact

  • When cloud access keys are stolen, direct access to production environments becomes possible.
  • Stolen session cookies are enough to take over cloud, email and SaaS sessions without a password or multi-factor authentication prompt.
  • Corporate passwords saved on personal devices also leak through infections outside the corporate network; these logs are sold to initial access brokers.
  • Log archives are reshared for years; as long as the password is not changed, the same credential can be used again and again.
  • Compromised email, messaging and social media accounts become the next link in phishing and malware distribution.
13

Defense

  • Replace cloud keys on developer devices with short-lived credentials.
  • Provide awareness training on commands pasted into Terminal.
  • When an infection is detected, revoke not only the password but all related sessions and access tokens.
  • Turn off password saving in the browser through corporate policy; use a corporate password manager.
  • Move to phishing-resistant multi-factor authentication (FIDO2/passkey); bind sessions to the device.
  • Block setup files downloaded from unlicensed software, game cheats and sponsored search results.
  • Monitor flows where the user runs a command by pasting it into the Run dialog or terminal (ClickFix) with endpoint rules.
  • Continuously monitor your corporate domains and employee email addresses in stealer logs with Dark Radar.
14

Learning center

How does this malware spread?
  • A shared AI chat tells the user to paste a command into Terminal (ClickFix).
How can its presence on a system be detected?
  • Sign-ins to accounts from an unrecognized country or device.
  • A new infostealer log in Dark Radar for your corporate domain or an employee email address.
Which macOS artifacts should be examined?
  • DMG files under ~/Downloads and the com.apple.quarantine attribute.
  • The user's Terminal history (~/.zsh_history).
  • Temporary ZIP archives under /tmp.
  • New plist files under ~/Library/LaunchAgents.
Which log records matter?
  • Unified log (log show)osascript processes and dialog boxes asking the user for a password.
  • TCC databaseFull Disk Access permission granted to Terminal or an unknown application.
  • Endpoint Security Framework (ESF)Processes accessing the Keychain file and browser profiles.
  • ~/.zshrc, LaunchAgentsLines and plist files added for persistence.
Which MITRE techniques is it associated with?
T1204.004User Execution: Malicious Copy and PasteT1059.002AppleScriptT1059.004Unix ShellT1546.004Unix Shell Configuration ModificationT1056.002GUI Input CaptureT1555.001KeychainT1555.003Credentials from Web BrowsersT1539Steal Web Session CookieT1552.001Credentials In FilesT1005Data from Local SystemT1560Archive Collected DataT1071.001Web ProtocolsT1041Exfiltration Over C2 Channel
How should a SOC analyst respond?
  1. Isolate the device from the network; do not reinstall it before taking memory and disk images.
  2. Determine the infection date; list all accounts that were signed in on the device after that date.
  3. Change the passwords of these accounts, revoke their sessions and access tokens, and re-enroll multi-factor authentication devices.
  4. Search identity provider and SaaS logs for new country, device and token usage after the infection.
  5. If a recovery phrase or wallet file was exposed, move the assets to a new wallet.
  6. Find the initial access path (email, ad, unlicensed software, fake CAPTCHA) and check other users who used the same path.
  7. Reinstall the device from a clean image.
15

Sources

Related families

Atomic macOS Stealer (AMOS)Poseidon StealerCompare

Related terms

Fileless malwareLiving off the land
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.

View productCompare plans