Full Report
Executive Summary MacSync Stealer is a family of macOS information stealers and remote-access stagers designed to evade detection and sold commercially under a malware-as-a-service (MaaS) model. In the attack chain, MacSync binaries are native stagers and multi-part exfiltration engines. Rather than standalone harvesters, the payloads are lightweight 64-bit Mach-O executables that detach silently from terminal […] The post MacSync: The Evasive macOS Stealer Exploiting ClickFix Lures appeared first on Seqrite Labs.
Analysis Summary
# Tool/Technique: MacSync Stealer
## Overview
MacSync Stealer is a sophisticated macOS-specific information stealer and remote-access stager. Operating under a Malware-as-a-Service (MaaS) model, it is designed for high evasion, utilizing a modular architecture to bypass Apple’s native security controls (Gatekeeper, XProtect) and enterprise EDR solutions. It primarily serves as a lightweight stager that fetches and executes credential-dumping modules in memory.
## Technical Details
- **Type:** Malware Family (Stealer/Stager)
- **Platform:** macOS (64-bit Mach-O)
- **Capabilities:** Credential harvesting, browser data theft, crypto-wallet extraction, session hijacking, and remote script execution.
- **First Seen:** Reported as emerging in 2025 (linked to earlier "Mac.C Stealer").
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1204.002 - User Execution: Malicious File
- **TA0002 - Execution**
- T1059.002 - AppleScript
- T1059.004 - Unix Shell
- **TA0003 - Persistence**
- T1543.001 - Launch Agent
- **TA0005 - Defense Evasion**
- T1027 - Obfuscated Files or Information
- T1564.001 - Hidden Files and Directories
- T1070.004 - File Deletion
- T1036.005 - Match Legitimate Name or Location
- T1562.001 - Disable or Modify Tools (Redirecting output to /dev/null)
- **TA0006 - Credential Access**
- T1555.001 - Keychain
- T1539 - Steal Web Session Cookie
- T1552.004 - Private Keys
- **TA0007 - Discovery**
- T1082 - System Information Discovery
- **TA0009 - Collection**
- T1560.001 - Archive via Utility
- **TA0011 - Command and Control**
- T1071.001 - Web Protocols (HTTPS)
- T1105 - Ingress Tool Transfer
- **TA0010 - Exfiltration**
- T1030 - Data Transfer Size Limits
- T1048.003 - Exfiltration Over Uncommonly Used Port (via HTTP PUT)
## Functionality
### Core Capabilities
- **Information Theft:** Targets browser vaults (cookies, saved passwords), system Keychains, cryptocurrency wallet databases, SSH keys, and AWS credentials.
- **System Fingerprinting:** Collects macOS version, hardware UUID, and CPU architecture.
- **Modular Loading:** Connects to C2 via HTTPS to download AppleScript payloads, which are executed directly in memory via `osascript`.
- **Exfiltration Engine:** Uses the `dd` utility to split large stolen archives into 10 MB chunks for stable transmission via HTTP PUT requests.
### Advanced Features
- **Stealth Daemonization:** Uses `fork()` and `setsid()` to detach from the terminal and reparent to `launchd` (PID 1), effectively running as a background daemon.
- **Single-Byte XOR Obfuscation:** Employs an inlined C++ template (`ObfuscatedString`) to decrypt sensitive strings (C2 URLs, API keys) only at runtime to evade static analysis.
- **Fileless Execution:** By piping payloads directly into `osascript` via `stdin`, the malware avoids writing its primary logic to the disk.
- **Self-Cleaning:** Automatically deletes temporary files (`/tmp/osalogging.zip` and `/tmp/.httpcode`) immediately following a successful C2 response.
## Indicators of Compromise
- **File Names:**
- `/tmp/osalogging.zip` (Staged data)
- `/tmp/.httpcode` (Status tracker)
- `com.utils.Launcher.plist` (Persistence)
- **Network Indicators (Defanged):**
- `hxxps[://]domain[.]com/dynamic?txd=[hash]` (Payload delivery)
- `hxxps[://]domain[.]com/gate?buildtxd=[hash]` (Exfiltration gate)
- Custom Header: `api-key: [Hexadecimal Key]`
- **Behavioral Indicators:**
- `osascript` receiving data via `stdin`.
- Binary calling `setsid()` and redirecting output to `/dev/null`.
- Sequential HTTP PUT requests containing binary data chunks.
- Usage of `security dump-keychain` and `dd` for file slicing.
## Associated Threat Actors
- **Mentalpositive** (Developer identity linked to Mac.C Stealer).
- Distributed via the **ClickFix** social engineering ecosystem and **ClearFake** affiliates.
## Detection Methods
- **Behavioral Detection:** Monitor for unexpected `osascript` activity where script content is not sourced from a file. Alert on processes detaching from terminal sessions to reparent to `launchd`.
- **Signature-based:** Scan for the custom C++ XOR obfuscation template and specific Mach-O headers.
- **Network Monitoring:** Inspect HTTPS headers for non-standard fields like `api-key:` or `campaign-token:`.
## Mitigation Strategies
- **User Education:** Train users to recognize "ClickFix" lures; specifically, never to copy-paste and run Terminal commands from pop-up windows.
- **Endpoint Hardening:** Implement MDM policies to restrict the execution of unsigned or unnotarized Mach-O binaries.
- **Access Control:** Use macOS Transparency, Consent, and Control (TCC) to limit application access to sensitive directories like `~/Library/Keychains` and Browser profiles.
## Related Tools/Techniques
- **Mac.C Stealer:** The predecessor to MacSync.
- **Atomic Stealer (AMOS):** A similar macOS MaaS stealer.
- **ClickFix / ClearFake:** The delivery framework used for distribution.