Full Report
Huntress SOC analysts reverse engineer MacSync Stealer, a macOS infostealer spread through fake Claude Code download pages. Watch the full analysis.
Analysis Summary
# Tool/Technique: MacSync Stealer
## Overview
MacSync is a sophisticated macOS-based infostealer and Remote Access Trojan (RAT) distributed via malvertising campaigns. Attackers leverage "ClickFix" tactics by poisoning Google Search results for popular software (like Claude Code) and directing users to legitimate-but-compromised AI platforms (like Anthropic’s `claude.ai`) that host malicious instructions. The malware is designed to exfiltrate credentials, browser data, and cryptocurrency assets.
## Technical Details
- **Type:** Malware family (Infostealer / RAT)
- **Platform:** macOS
- **Capabilities:** Credential harvesting, crypto-wallet draining, remote access, screen recording, and keychain theft.
- **First Seen:** July 2026 (Reported August 2026)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.003 - Phishing: Spearphishing Service (via shared Claude conversations)]
- [T1583.008 - Acquire Infrastructure: Malvertising]
- **[TA0002 - Execution]**
- [T1059.004 - Command and Scripting Interpreter: Unix Shell]
- [T1059.002 - Command and Scripting Interpreter: AppleScript]
- **[TA0005 - Evasion]**
- [T1027 - Obfuscated Files or Information]
- [T1036 - Masquerading (Using "Apple Support" display names)]
- **[TA0006 - Credential Access]**
- [T1555.001 - Credentials from Password Stores: Keychain]
- [T1539 - Steal Web Session Cookie]
- **[TA0009 - Collection]**
- [T1113 - Screen Capture]
## Functionality
### Core Capabilities
* **Multi-Stage Kill Chain:** Utilizes a six-stage deployment process starting from a simple `curl` one-liner to a full-featured RAT.
* **Browser Data Theft:** Targets and exfiltrates browser cookies, login credentials, and saved form data.
* **System Secret Harvesting:** Specifically targets the macOS Keychain, SSH keys, and cloud provider access keys.
* **Session Hijacking:** Steals active Telegram sessions and other communication application tokens.
### Advanced Features
* **Server-Side Logic:** Uses a server-side AppleScript stealer to keep primary malicious logic off the local disk, requiring an `api-key` to trigger.
* **Crypto-Targeting:** Features a robust suite of wallet-depleting tools, including trojanized hardware wallet companion apps and spoofed wallet browser extensions.
* **TCC Permission Bypass:** Includes a separately signed helper specifically designed to prompt for and steal "Screen Recording" permissions.
* **Native Mach-O RAT:** Provides attackers with hands-on, interactive access to the infected macOS device.
## Indicators of Compromise
* **File Names:**
* `zsh` loader scripts (Stage 1)
* Trojanized wallet apps
* **Network Indicators (Defanged):**
* `claude[.]ai` (Legitimate domain hosting malicious shared conversation artifacts)
* Attackers use specific `User-Agent` strings (macOS-specific) and `api-key` headers to serve payloads.
* **Behavioral Indicators:**
* Execution of `curl | zsh` commands from Terminal via user copy-paste.
* Unexpected TCC (Transparency, Consent, and Control) prompts for "Screen Recording" from unknown or suspicious helper utilities.
* Background processes running `daemon_function` scripts.
## Associated Threat Actors
* Unknown (The campaign utilizes the **ClickFix** tactic, previously associated with distributors of AMOS Stealer and SectopRAT).
## Detection Methods
* **Signature-based detection:** Scanning for the Stage 4 native Mach-O RAT and Stage 5 signed helper binaries.
* **Behavioral detection:** Monitoring for suspicious `curl` activity in Terminal that pipes directly to a shell (`zsh`, `sh`, `bash`).
* **Telemetry Monitoring:** Tracking unauthorized access to sensitive file paths like `~/Library/Keychains/` and browser profile directories.
## Mitigation Strategies
* **User Training:** Educate users to never copy-paste `curl | sh` commands from websites, even those hosted on trusted domains like `claude.ai` or `chatgpt.com`.
* **Safe Browsing:** Use ad-blockers to filter out "Sponsored" search results that frequently lead to malvertising.
* **Endpoint Security:** Deploy EDR/MDR solutions capable of monitoring macOS-specific behaviors (AppleScript execution, TCC prompt monitoring).
* **Hardening:** Implement strict MDM policies to prevent the execution of unsigned or non-notarized applications.
## Related Tools/Techniques
* **AMOS (Atomic macOS Stealer):** Another macOS stealer distributed via similar ClickFix/AI-themed malvertising.
* **SectopRAT:** A .NET-based RAT also observed using fake Claude Desktop lures.
* **ClickFix:** The specific social engineering technique of providing "fix" instructions that require Terminal execution.