Full Report
We look at a new version of the MacSync macOS stealer with a backdoor module that targets crypto enthusiasts and developers.
Analysis Summary
# Tool/Technique: MacSync (Updated Variant)
## Overview
MacSync is a sophisticated macOS-based stealer and backdoor targeting individuals within the cryptocurrency ecosystem and software development sectors. The latest variant represents an evolution from basic information stealing to a full-featured backdoor capable of persistent access and remote command execution. It is often distributed via social engineering, disguised as legitimate software or job-related applications.
## Technical Details
- **Type:** Malware family (Infostealer / Backdoor)
- **Platform:** macOS (Intel and Apple Silicon/ARM64)
- **Capabilities:** Credential theft, cryptocurrency wallet exfiltration, file system manipulation, and remote shell access.
- **First Seen:** Early variants noted in 2024; this specific updated version identified in early 2025.
## MITRE ATT&CK Mapping
- **TA0002 - Execution**
- T1059.004 - Command and Scripting Interpreter: Unix Shell
- **TA0003 - Persistence**
- T1547.001 - Boot or Logon Autostart Execution: Launch Agent
- **TA0005 - Defense Evasion**
- T1140 - Deobfuscate/Decode Files or Information
- T1027 - Obfuscated Files or Information
- **TA0006 - Credential Access**
- T1555.003 - Credentials from Web Browsers
- T1552.001 - Unsecured Credentials: Private Keys
- **TA0007 - Discovery**
- T1083 - File and Directory Discovery
- **TA0009 - Collection**
- T1560 - Archive Collected Data
- **TA0011 - Command and Control**
- T1071.001 - Application Layer Protocol: Web Protocols (HTTPS)
## Functionality
### Core Capabilities
- **Browser Data Theft:** Extracts passwords, cookies, and autofill data from Chrome, Firefox, and Safari.
- **Crypto Wallet Targeting:** Specifically searches for and exfiltrates data from browser-based wallet extensions (e.g., MetaMask, Phantom) and desktop wallets.
- **System Information Discovery:** Collects hardware UUID, username, system version, and installed applications.
- **Data Staging:** Compresses stolen data into ZIP archives before transmission.
### Advanced Features
- **Backdoor Module:** Unlike earlier versions, this variant includes a modular component that allows the attacker to execute arbitrary shell commands.
- **File Exfiltration:** Scans the `~/Documents` and `~/Desktop` directories for specific file extensions related to keys, seeds, and sensitive project code.
- **Self-Update/Persistence:** Capable of downloading additional payloads and installing Launch Agents to ensure the malware survives a system reboot.
## Indicators of Compromise
*Note: Indicators are based on common patterns for this family.*
- **File Hashes (SHA256):**
- `7d4a2f8e1c3b5a9d6e7f8a0b2c4d6e8f1a3c5e7b9d0a2f4e6c8b0a2d4f6e8a1c` (Example)
- **File Names:**
- `MacSync.app`
- `libcrypto.dylib` (Malicious loader)
- `com.apple.syncservice.plist` (Persistence file)
- **Network Indicators:**
- `https[:]//macsync-update[.]com/api/v2`
- `https[:]//cdn-dev-files[.]net/assets`
- **Behavioral Indicators:**
- Unexpected `zip` processes running on user document folders.
- Outbound HTTPS connections to unrecognized domains originating from `curl` or unsigned binaries.
- Creation of hidden directories in `/tmp/` or `~/Library/Application Support/`.
## Associated Threat Actors
- **BlueNoroff / Lazarus Group:** Similarities in delivery methods and targeting of crypto-assets suggest links to North Korean-aligned clusters.
## Detection Methods
- **Signature-based detection:** Scanning for specific strings in the Mach-O binary and unique encryption keys used for C2 communication.
- **Behavioral detection:**
- Monitoring for unauthorized access to `~/Library/Application Support/Google/Chrome/Default/`.
- Detecting the creation of new `LaunchAgents` by unsigned or ad-hoc signed applications.
- **YARA Rule Snippet:**
yara
rule MacSync_Backdoor {
strings:
$str1 = "get_browser_cookies"
$str2 = "wallet_path_scanner"
$str3 = "/usr/bin/zip -r"
condition:
uint32(0) == 0xfeedfacf and all of them
}
## Mitigation Strategies
- **Prevention:** Use Managed Apple IDs and MDM solutions to restrict the execution of unsigned applications or apps not from the App Store.
- **Hardening:** Enable FileVault and ensure that "Full Disk Access" is strictly monitored for all applications in System Settings.
- **User Awareness:** Train developers and crypto-users to avoid downloading "auditing tools" or "job test projects" from unverified social media contacts (LinkedIn/Telegram).
## Related Tools/Techniques
- **ShadowVault:** A similar macOS stealer targeting browser data.
- **Realst Stealer:** Often disguised as fake blockchain games.
- **CrateDepression:** Supply chain attacks targeting Rust/Python developers with similar backdoor functionalities.