MacSync macOS Infostealer Exploits ClickFix-style Attack to Trick Users with Single Terminal Command
## Cybersecurity: macOS Infostealer Campaign Targeting Cryptocurrency Users
Cybersecurity: macOS Infostealer Campaign Targeting Cryptocurrency Users
A recent macOS infostealer campaign employs social engineering tactics to distribute MacSync, a Malware-as-a-Service (MaaS) tool aimed at stealing credentials from cryptocurrency users.
The campaign begins with phishing redirects and leads to trojanized hardware wallet applications, providing persistent access to attackers. Initially, it utilizes credential harvesters that mimic Microsoft login pages. The analysis of the domain crosoftonline[.]com/login[.]srf shows HTTP redirects to macclouddrive[.]com/s2/ , a deceptive macOS cloud storage installer page.
The lure page features a Terminal command under the guise of "advanced installation," with a fake App Store appearance and a prominent copy button. This method targets "advanced users," offering a single command as an alternative to standard downloads.
The payload decodes to retrieve code from jmpbowl[.]xyz , initiating a multi-stage infection that compromises browser credentials, cryptocurrency wallets, and system Keychain data.
The command uses a base64-encoded URL to Zsh, bypassing Gatekeeper and notarization. It downloads a daemonized Zsh loader, which runs in the background, hiding from Terminal view.
The campaign begins with phishing redirects and leads to trojanized hardware wallet applications, providing persistent access to attackers.
The stager retrieves an AppleScript core payload from dynamic endpoints using unique tokens for victim tracking. It redirects output to /dev/null , ensuring silent execution while maintaining connection with command-and-control (C2) servers through hardcoded API keys.
The AppleScript module systematically collects data from:
Browser profiles from Chromium derivatives such as Chrome, Brave, and others Over 25 cryptocurrency wallet extensions, including MetaMask and Binance Wallet Desktop wallet applications like Exodus and Electrum Complete Keychain databases SSH keys, AWS credentials, and Kubernetes configurations Telegram session data and Apple Notes databases Files from Desktop, Documents, and Downloads
The script uses phishing dialogs mimicking "System Preferences" to repeatedly prompt for the macOS login password, saving it in plaintext.
MacSync employs advanced techniques, including social engineering and multi-stage evasion, for data harvesting and post-compromise persistence. It escalates infections by trojanizing applications like Ledger Wallet.app and Trezor Suite.app. The malicious bundle overwrites specific files, preserving legitimate resources to minimize detection while bypassing Gatekeeper validation.
The campaign targets cryptocurrency users and hardware wallet applications, indicating a focus on high-value targets within the macOS ecosystem. It utilizes multiple C2 domains, indicating an evolving campaign. Each build receives unique tokens for precise victim tracking and payload customization.
This campaign's reliance on script-based execution complicates detection, while trojanization ensures prolonged access only on systems with valuable applications.
Based on reporting by GBHackers.