Fake job task and hijacked AI tool in $6.34 billion Binance theft
Attackers used a stolen deployment token and EIP-7702 delegation; about $2.85 billion was frozen or intercepted.
92
Malware
MacSync Stealer
- Mentions · 7d1
- Mentions · 30d1
- All mentions5
- First seenAug 17, 2026
- Last mentioned13h ago
Timeline
5 articles · newest firstHackers Use ClickFix Lures to Deploy MacSync Stealer and Bypass macOS Security.
ClickFix malvertising campaigns deliver MacSync, a macOS infostealer sold as MaaS that bypasses Gatekeeper via Terminal commands and steals credentials.
58
Microsoft Tracks MacSync Stealer by Its Behavior, Not Its Domains
Microsoft correlates over 30 rotating domains to track MacSync Stealer, which steals passwords, SSH keys, wallets and AWS credentials.
50
Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure
Microsoft links 30+ rotating domains to the MacSync macOS infostealer, confirming active credential and file exfiltration through chunked HTTP PUT uploads.
58
MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer
Huntress dissects MacSync Stealer, a macOS infostealer delivered through fake Claude Code download pages in Google search results.
55
Appears with
- Microsoftvendor · 3
- Claudeai model · 2
- Microsoftorganization · 2
- macOSproduct · 2
- Applevendor · 2
- RST Cloudorganization · 2
- AWSvendor · 1
- Atomic Stealer (AMOS)malware · 1
- Huntressvendor · 1
- TraderTraitorthreat actor · 1
- Binancevictim · 1
- Kubernetesproduct · 1
- curlproduct · 1
- AppleScriptproduct · 1
- FBIorganization · 1
- ClickFixorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.