MacSync under the microscope: new delivery methods and a new payload
MacSync, a crypto/info stealer with a backdoor module, was spotted in the wild in September 2026 with new binary payload delivery methods.
70
Product
MacSync
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 10, 2026
- Last mentionedSep 24, 2026
Timeline
2 articles · newest firstHackers Use ClickFix Lures to Deploy MacSync Stealer and Bypass macOS Security.
ClickFix malvertising campaigns deliver MacSync, a macOS infostealer sold as MaaS that bypasses Gatekeeper via Terminal commands and steals credentials.
58
Appears with
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.