Full Report
We reverse-engineered MacSync, a six-stage macOS stealer and RAT, recovered from attacker infrastructure after the victim’s host was taken offline.
Analysis Summary
# Tool/Technique: MacSync
## Overview
MacSync is a sophisticated, six-stage malware suite targeting macOS users. It functions as both a highly targeted information stealer and a Remote Access Trojan (RAT). The malware is delivered via social engineering—specifically "ClickFix" style attacks—where victims are tricked into executing Terminal commands from fake AI installation guides (e.g., Claude AI) hosted on legitimate platforms.
## Technical Details
- **Type:** Malware family (Stealer / RAT)
- **Platform:** macOS
- **Capabilities:** Credential harvesting, TCC permission bypass, Remote Access, Crypto-wallet hijacking, Persistence.
- **First Seen:** July 2024 (reported July 29, 2026/current reporting period).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1204.002 - User Execution: Malicious File]
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0002 - Execution]**
- [T1059.004 - Command and Scripting Interpreter: Unix Shell]
- [T1059.002 - Command and Scripting Interpreter: AppleScript]
- **[TA0005 - Defense Evasion]**
- [T1553.002 - Subvert Trust Controls: Code Signing]
- [T1027 - Obfuscated Files or Information]
- **[TA0006 - Credential Access]**
- [T1555.001 - Credentials from Password Stores: Keychain]
- [T1539 - Steal Web Session Cookie]
- **[TA0009 - Collection]**
- [T1113 - Screen Capture]
- [T1560 - Archive Collected Data]
## Functionality
### Core Capabilities
- **Multi-Stage Loading:** Uses a thin `zsh` loader to pull down subsequent stages, keeping the primary malicious logic off the disk initially.
- **Information Theft:** Scrapes browser cookies, login credentials, Keychain secrets, SSH keys, cloud provider keys, and Telegram sessions.
- **Credential Phishing:** Tricks users into providing their system password via fake administrative prompts to facilitate further access.
- **TCC Permission Exploitation:** Includes a signed helper specifically designed to prompt for and acquire "Screen Recording" permissions.
### Advanced Features
- **Server-Side Stealer Logic:** Utilizes AppleScript hosted on the C2 server (protected by an API key) to perform stealing actions, making detection of the local footprint harder.
- **Mach-O RAT:** Drops a native Mach-O binary for persistent, hands-on-keyboard remote access.
- **Wallet Trojanization:** Identifies existing cryptocurrency wallet applications (roughly 60 extensions and 21 desktop apps) and overwrites them with trojanized versions that phish for recovery seed phrases.
## Indicators of Compromise
- **File Names:** `macsync`, `setup.sh` (loader), various trojanized wallet app names.
- **Network Indicators:**
- `agenticsora[.]com` (Delivery)
- `malwareaudit[.]com` (Delivery)
- `103.216.221[.]95` (Operator IP/Stealer Beacon)
- `84.206.161[.]241:8443` (Dedicated RAT C2)
- **Behavioral Indicators:**
- Unexpected `curl | zsh` commands executed in Terminal.
- Sudden requests for "Full Disk Access" or "Screen Recording" for unknown or "System" utilities.
- Modification of application files within the `/Applications` directory, specifically crypto wallets.
## Associated Threat Actors
- Currently associated with campaigns leveraging **"ClickFix"** social engineering and malvertising tactics similar to those used by AMOS (Atomic Stealer) and SectopRAT operators.
## Detection Methods
- **Signature-based:** Monitoring for known Mach-O RAT hashes and the `zsh` loader scripts.
- **Behavioral detection:**
- Identify `curl` processes piping output directly into `zsh` or `sh`.
- Alert on `osascript` (AppleScript) execution that attempts to access sensitive directories like `~/Library/Keychains` or browser profile folders.
- Monitor for unauthorized modification of `.app` bundles in the Applications folder.
- **YARA Rules:** Target the unique AppleScript strings and the specific Mach-O RAT communication protocols.
## Mitigation Strategies
- **User Education:** Train users never to copy-paste Terminal commands from websites, even if the site appears to be a legitimate support guide.
- **Least Privilege:** Discourage the use of administrative accounts for daily tasks; restrict "Full Disk Access" permissions.
- **App Sandboxing & Hardening:** Use MDM (Mobile Device Management) to restrict the execution of unsigned binaries or scripts from the `/tmp` directory.
- **Browser Security:** Implement strict ad-blocking to mitigate malvertising (sponsored search results).
## Related Tools/Techniques
- **AMOS (Atomic Stealer):** Shares similar delivery methods via poisoned AI guides.
- **SectopRAT:** Previously observed in similar fake Claude desktop campaigns.
- **ClickFix:** The overarching technique of providing a "fix" that requires the user to run a malicious command.