New MacSync Stealer Uses Signed macOS App to Evade Gatekeeper and Steal Data

Cybersecurity researchers have identified a new variant of the MacSync malware targeting macOS users. This iteration disguises itself as a legitimately signed and notarized Apple application, thereby bypassing the macOS Gatekeeper security and accessing sensitive data.

Jamf Threat Labs has identified this evolved MacSync stealer, which includes two significant technical changes. The malware now presents itself as a code-signed and notarized Swift application, Apple's official programming language for macOS development. This approach allows the malware to evade detection by appearing as a trusted app from a verified developer.

The cybercriminals obtain legitimate developer certificates through theft, purchasing compromised developer accounts, or establishing fake developer companies using fraudulent identities. By leveraging these certificates, MacSync avoids triggering macOS security warnings about "unidentified developers" that would typically alert users to potential threats.

The new variant impersonates online messaging platforms, targeting users interested in applications like zk-Call, an Estonia-based call and messenger service. This social engineering tactic increases the likelihood that victims will install the malicious software without suspicion.

This MacSync version represents a significant departure from its predecessors. Earlier variants were lightweight, running modular payloads directly in memory without a substantial disk footprint. However, Jamf researchers noted this version features a large disk image of 25.5MB, suggesting enhanced functionality and embedded components.

MacSync poses serious threats to infected systems. The malware can install backdoors for remote system control, steal stored data and browser information, target cryptocurrency wallet credentials, and maintain persistent hidden access.

Jamf identified focusgroovy[.]com as a command-and-control server used to fetch additional payloads, with web browsers now flagging the site for suspected phishing activity, as reported by Moonlock. While the exact distribution method remains unclear, potential infection vectors include malicious advertising campaigns, social media exploitation, search engine manipulation, and targeted spear-phishing attacks.

Mac users are advised to remain vigilant and avoid downloading applications from untrusted sources, even if they appear legitimately signed.

Based on reporting by Cyber Security News.