Mac users are facing a new threat with the emergence of MacSync Stealer, a sophisticated malware that leverages social engineering tactics to extract sensitive information. This malware employs a technique known as ClickFix, where users are deceived into pasting malicious commands into the Terminal, initiating the infection process.
Once activated, MacSync Stealer systematically searches for and collects a wide array of personal data. This includes browser credentials, Keychain information, cloud and SSH credentials, cryptocurrency wallet details, Apple Notes, and files stored in common directories. The stolen data can lead to unauthorized access to personal accounts, financial losses, and exposure of confidential files.
A notable aspect of MacSync Stealer’s operation is its use of a rapidly changing network infrastructure. The malware rotates through over 30 domains, making it challenging for traditional blocklists to effectively prevent its activities. This dynamic approach complicates detection and mitigation efforts, as the malware’s infrastructure is continually evolving.
Security researchers have identified consistent behavioral patterns across these domains, such as specific request paths, Mac-style browser identifiers, API-key headers, curl options, and chunked uploads. These recurring traits provide a more reliable method for identifying the malware’s activities, despite its shifting network infrastructure.
MacSync Stealer utilizes built-in macOS tools to execute its malicious activities, maintaining a low profile by mimicking normal system operations. It initiates from an interactive zsh session, employs curl to fetch content, and uses Base64, gunzip, and AppleScript-assisted commands to unpack and execute its payload. This method is reminiscent of previous campaigns that exploited similar techniques to bypass user safeguards.
After gathering the targeted information, the malware stores it in temporary folders, compresses it into an archive, and transmits it to remote servers. The data is divided into smaller segments and uploaded via HTTP PUT requests. Following the data exfiltration, MacSync Stealer deletes the temporary files and folders, leaving minimal traces of its activities.
To protect against such threats, users should exercise caution and avoid pasting commands into the Terminal from untrusted sources, including websites, chat messages, applications, files, or unsolicited instructions. Organizations are advised to educate their staff on recognizing these social engineering tactics, monitor for unexpected shell and osascript activities, and scrutinize curl traffic that involves data uploads. Implementing restrictions on suspicious outbound connections and securing password stores can further mitigate potential damages.
The emergence of MacSync Stealer underscores the evolving landscape of macOS malware. Its sophisticated use of social engineering, combined with a rapidly changing network infrastructure, highlights the need for continuous vigilance and adaptive security measures. As attackers refine their methods, both users and organizations must stay informed and proactive to effectively counter these threats.
