MacSync Stealer Malware Targets macOS Users Through Digitally Signed Apps

Jamf Threat Labs has identified a new MacSync Stealer campaign that utilizes Apple's trust mechanisms to deliver malware on macOS systems. This latest variant is a fully code-signed and notarized Swift application, which allows it to appear as legitimate software while executing a multi-stage infostealing routine in the background.

Jamf researchers, using in-house YARA rules, detected a signed, notarized stealer that deviated from the typical execution patterns of earlier MacSync Stealer samples. The delivery mechanism has been revamped, moving away from previous versions that relied on user interaction through terminal scripts or instructions. This campaign employs a deceptive approach, maintaining the right-click open instruction despite the executable being signed and not requiring it.

The malware is distributed as a disk image named zk-call-messenger-installer-3.9.2-lts.dmg , available at zkcall.net/download . Within it is a Swift-based application that is code-signed and notarized, facilitating installation without explicit terminal use.

Overview of the MacSync Stealer Threat

Jamf confirmed that the Mach-O binary is a universal build signed under Developer Team ID GNJLS3UYZ4 and notarized by Apple. Initial checks on Apple's revocation list showed no revocations, allowing the app to pass Gatekeeper checks until Jamf reported the abuse, leading to Apple's certificate revocation.

The disk image is notably large at 25.5 MB, inflated by decoy files, including PDFs related to LibreOffice, designed to distract from the malicious components.

Initial detections were limited, with few antivirus engines flagging it as a downloader linked to known malware families. This low detection rate highlights how code signing and notarization can help malware evade early detection.

Jamf's YARA-based threat prevention detected an obfuscated bash script executing from /tmp/runner . Further investigation linked this script to a signed application run from a disk image, confirming it acted as a dropper. Once decoded, the payload matched known MacSync Stealer behavior.

Analysis of the universal Mach-O binary, named runtimectl , revealed a sophisticated second-stage loader in Swift. The _main function manages logging, creates a working directory, checks internet connectivity, and enforces execution timing intervals to avoid detection.

The core malicious logic resides in the runInstaller() function, which rate limits, verifies connectivity, cleans up previous artifacts, and fetches a second-stage payload. The response is stored in /tmp/runner .

The malware's curl command deviates from earlier scripts by altering flag combinations and introducing dynamic variables to increase reliability and evade detection.

Before executing the downloaded script, the malware removes the com.apple.quarantine attribute and ensures executability. It then validates the file as a shell script, checking for expected patterns.

Jamf notes that similar strategies are being adopted by other malware, such as Odyssey infostealer, signaling a shift towards using notarized apps for macOS malware distribution. A Gatekeeper check is performed to blend malicious activities with expected security flows.

Once the payload executes, it exhibits behaviors consistent with MacSync Stealer, including data theft. This evolution allows attackers to appear legitimate and evade early detection.

Security teams are advised not to rely solely on code signing and notarization as trust indicators. Jamf recommends enabling advanced threat controls in block mode to detect and prevent such campaigns before data exfiltration occurs.

Based on reporting by GBHackers.