Full Report
Huntress’ AI-Centric SOC recently stopped a MacSync infostealer attack on a macOS device. The malware attempted to scrape credentials, browser cookies, and crypto wallets, but Huntress contained the threat before any data was sent to the attacker. Learn how we did it.
Analysis Summary
# Incident Report: Containment of MacSync Infostealer
## Executive Summary
Huntress’ AI-Centric SOC detected and thwarted a MacSync infostealer attack targeting a macOS device. The malware successfully socially engineered a user into providing administrative credentials, allowing it to stage sensitive data including Keychain credentials and crypto wallets. The incident was resolved through host isolation, preventing any data exfiltration to the attacker's command-and-control server.
## Incident Details
- **Discovery Date:** Prior to March 18, 2026 (Report Published Date)
- **Incident Date:** Circa March 2026
- **Affected Organization:** Not disclosed (Huntress Partner/Customer)
- **Sector:** Not disclosed
- **Geography:** Not disclosed
## Timeline of Events
### Initial Access
- **Date/Time:** Circa March 2026
- **Vector:** Social Engineering / Phishing
- **Details:** The user was presented with a deceptive "macOS Protection Service" pop-up dialog box. The prompt used awkward phrasing: *"In order to process action required. Input device password to authorize your access."* The user entered their system password, granting the malware elevated permissions.
### Lateral Movement
- **Details:** No lateral movement was reported; the malware focused on local reconnaissance and data harvesting on the infected endpoint.
### Data Exfiltration/Impact
- **Staging:** Data was scraped and moved to a local staging directory at `/tmp/salmonela/`.
- **Targeted Data:** Chrome cookies, Safari data, Apple Keychain credentials, and over 200 cryptocurrency wallet types.
- **Outcome:** The attacker attempted to zip the folder and use `curl` for exfiltration, but the process was blocked. **No data was successfully exfiltrated.**
### Detection & Response
- **Detection:** Huntress Managed EDR flagged suspicious processes and the use of "LOOBins" (Living off the Orchard Binaries) like `curl` to move staged data.
- **Response:** The Huntress SOC verified the malicious behavior, isolated the host from the network to prevent C2 communication, and provided the partner with remediation steps to evict the adversary.
## Attack Methodology
- **Initial Access:** Social Engineering (Fake system prompt).
- **Persistence:** Not explicitly detailed, though the malware functioned as a 6-stage Stealer/RAT.
- **Privilege Escalation:** Exploited user trust to obtain the system password via a fake dialog box.
- **Defense Evasion:** Use of legitimate system binaries (LOOBins) to perform tasks; attempt to delete the ZIP archive after the (failed) exfiltration attempt.
- **Credential Access:** Scraping Apple Keychain and browser-stored credentials (Chrome/Safari).
- **Discovery:** Automated scraping of the disk for documents, notes, and crypto wallet files.
- **Lateral Movement:** N/A.
- **Collection:** Staging data in a hidden/temporary directory (`/tmp/salmonela/`).
- **Exfiltration:** Attempted via `curl` POST request to a C2 domain.
- **Impact:** Potential for total identity theft and financial loss via crypto wallet drainage.
## Impact Assessment
- **Financial:** Minimal (Prevented); potential for high loss due to 200+ targeted crypto wallets.
- **Data Breach:** None; exfiltration was blocked before completion.
- **Operational:** Low; limited to one isolated endpoint and remediation time.
- **Reputational:** None.
## Indicators of Compromise
- **Network indicators:** Sketchy C2 domain (URL not explicitly listed in text, but utilized via `curl`).
- **File indicators:**
- Directory: `/tmp/salmonela/`
- Filename: `salmonela.zip` (implied staging archive)
- **Behavioral indicators:**
- Unexpected "macOS Protection Service" prompts.
- `curl` commands posting large amounts of data from `/tmp` to external IPs.
- Non-standard binaries accessing Apple Keychain.
## Response Actions
- **Containment:** Managed EDR host isolation to sever C2 communication.
- **Eradication:** Implementation of SOC-provided remediation steps to remove malware artifacts.
- **Recovery:** Restoration of the host to a known-safe state and credential rotation.
## Lessons Learned
- **macOS Vulnerability:** The assumption that macOS is "immune" to malware persists among users, making them susceptible to basic social engineering.
- **Poor Tradecraft:** The attacker’s misspelling of "salmonella" as "salmonela" serves as a minor behavioral artifact, though it did not hinder the malware's scraping capabilities.
- **Detection Efficacy:** Monitoring "Living off the Orchard Binaries" (LOOBins) is critical for detecting exfiltration attempts that bypass traditional file-scanning signatures.
## Recommendations
- **User Training:** Educate employees on the appearance of legitimate macOS system prompts vs. third-party application prompts.
- **Security Software:** Deploy EDR solutions specifically optimized for macOS telemetry.
- **Least Privilege:** Discourage the use of administrative accounts for daily tasks to mitigate the impact of password prompts.
- **Credential Hygiene:** Use a dedicated Password Manager rather than relying solely on browser-based storage or Keychain for high-value credentials.