New MacSync Stealer Malware Attacking macOS Users Using Digitally Signed Apps

Cybersecurity: MacSync Stealer Malware Update

A newly updated version of the MacSync Stealer malware is targeting macOS users via digitally signed and notarized applications, indicating a significant change in the delivery method of this threat.

The recent variant operates silently in the background, contrasting with older versions that required user interaction with Terminal. The malware masquerades as a legitimate installer, distributed via a fraudulent website under the filename zk-call-messenger-installer-3.9.2-lts.dmg. Upon installation, it executes a hidden script to extract sensitive information from the victim's system.

The malware is developed as a Swift application and is signed with Apple's Developer Team ID GNJLS3UYZ4. This signing allows it to bypass macOS's initial security alerts for untrusted applications. At the time of discovery, Apple's certificate for this malware had not been revoked, facilitating its installation without triggering security warnings. The disk image file is 25.5MB, containing fake PDF files related to LibreOffice to enhance its appearance as legitimate software.

When submitted to VirusTotal, some antivirus engines identified it as a generic downloader linked to other malware families. Jamf analysts discovered this malware while monitoring their detection systems, noting its deviation from previous MacSync campaigns, which typically utilized drag-to-terminal or ClickFix methods.

Following confirmation of the threat, Jamf Threat Labs reported the malicious Developer Team ID to Apple, leading to the subsequent revocation of the certificate.

Swift-Based Execution and Payload Delivery

The malware employs a Swift-based helper program named runtimectl, which manages the infection process. Upon execution, it verifies the system's internet connection using the checkInternet() function. If connected, it downloads a second-stage payload from a specified URL using a curl command and saves it to /tmp/runner. This script is verified as a valid shell script before execution.

The malware removes the com.apple.quarantine flag and sets file permissions to make the script executable. Log files are created at ~/Library/Logs/UserSyncWorker.log, and tracking files are stored in ~/Library/Application Support/UserSyncWorker/ to monitor activity and prevent frequent executions. The malware includes a rate-limiting mechanism, ensuring it runs only once every 3600 seconds.

Upon execution, the /tmp/runner file is deleted to eliminate traces, and the malware connects to a command-and-control server for downloading additional payloads.

Based on reporting by Cyber Security News.