New MacSync Malware Turns macOS Apps Into Tools for Crypto and Password Theft
AI summary · grok-4.7Summaries by Vani AI
MacSync returned on macOS via fake wallet apps that steal passwords, crypto wallets, and developer credentials.
Kaspersky's Securelist reported that the MacSync macOS infostealer returned in September 2026 with a multi-stage chain aimed at cryptocurrency users and developers. Campaigns use malicious disk images posing as real apps, including a nonexistent wallet called Toria promoted on social media, and can deliver a Swift stealer plus an HTTP backdoor on Apple Silicon and Intel Macs. The stealer collects browser secrets, Keychain files, wallet data, Telegram information, and SSH, AWS, Kubernetes, and Git configuration. Operators persist through a LaunchAgent, ZSH startup files, and Git hooks; one path hides commands in a public iCloud calendar. No victim count was published.
Key facts
- Delivery shifted to malicious disk images, including a fake Toria crypto wallet.
- The Swift stealer collects browsers, Keychain, wallets, SSH, AWS, Kubernetes, and Git data.
- Persistence includes a LaunchAgent, ZSH startup settings, and global Git hooks.
- One chain retrieves commands hidden in a public iCloud calendar event.
- Kaspersky identified the chain in September 2026; no victim count was published.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | apple03cloudstore.com | x/installer.sh Installer script location. URL hxxps://slack.apple03cloudstore[.]com/installer.sh Installer script location. URL hxxps://toria |
| domain | appstore.com.mx | Ke-EuEyQL iCloud archive attachment. C2 URL hxxps://docsend.appstore[.]com[.]mx Command-and-control address. C2 URL hxxps://toria.apple |
| domain | icloud.com | /Helper.pkg.enc Encrypted helper package. URL hxxp://caldav.icloud[.]com/published/2/MTk1NDMwMDMzNTUxOTU0M1aHCZ-nMxiyGzBTzPiodOf44 |
| domain | toria.app | 9d144d4661bc66f2ec49f9f Auxiliary autorun tool. URL hxxps://toria[.]app/ Fake wallet website. URL hxxps://warpcast[.]asia/Toria.d |
| domain | warpcast.asia | . URL hxxps://toria[.]app/ Fake wallet website. URL hxxps://warpcast[.]asia/Toria.dmg Malicious disk-image location. URL hxxps://stre |
| md5 | 00d12d842596bf5ee1805effb4571d30 | MD5 f97d24212fa6a21be0c4d211e10f044c Stage five script. MD5 00d12d842596bf5ee1805effb4571d30 Stage six script. MD5 9a0043d900a9ac78c886c59c9a328fd0 Stag |
| md5 | 26a0f7cdb9f7dc5ace9a40af825b1538 | ators of compromise (IoCs):- Type Indicator Description MD5 26a0f7cdb9f7dc5ace9a40af825b1538 Stage one loader. MD5 2d69812584269699fade26622e6490c5 Stag |
| md5 | 2d69812584269699fade26622e6490c5 | MD5 26a0f7cdb9f7dc5ace9a40af825b1538 Stage one loader. MD5 2d69812584269699fade26622e6490c5 Stage one loader. MD5 7df1049cbd56c0bfa4a3364a379b4c2c Stag |
| md5 | 3ded1d71a822b53b12c3b67bcaf633f5 | MD5 6791dad263cac6d63ebba6a4b57e7d71 Stage one loader. MD5 3ded1d71a822b53b12c3b67bcaf633f5 Malicious calendar, stage two. MD5 781ce50001d4b449600afa34 |
| md5 | 3deeed48fd38f22e369f5c3092bd68a1 | 5 f9f70096aabb4d22a6657014f4853a53 Stage three dropper. MD5 3deeed48fd38f22e369f5c3092bd68a1 Stage four dropper. MD5 f97d24212fa6a21be0c4d211e10f044c St |
| md5 | 4203ec932bfcc0907f91732440d6d997 | 5 980e2134679bc0c609f7659882883d77 Stage three dropper. MD5 4203ec932bfcc0907f91732440d6d997 Stage three dropper. MD5 eb760d5c88f13f7ee0f8f86ba3407123 S |
| md5 | 6791dad263cac6d63ebba6a4b57e7d71 | MD5 fb90887592655a8c989e443c640167aa Stage one loader. MD5 6791dad263cac6d63ebba6a4b57e7d71 Stage one loader. MD5 3ded1d71a822b53b12c3b67bcaf633f5 Mali |
| md5 | 7212229c85852c3bffaf9740002b2f39 | MD5 9a0043d900a9ac78c886c59c9a328fd0 Stage six script. MD5 7212229c85852c3bffaf9740002b2f39 Auxiliary repair script. MD5 c53d0ea45dbc622afb7f16ea3eec78 |
| md5 | 781ce50001d4b449600afa347c9b0208 | a822b53b12c3b67bcaf633f5 Malicious calendar, stage two. MD5 781ce50001d4b449600afa347c9b0208 Stage three dropper. MD5 8e84b01d5ac9624f0b181ade0e737193 S |
| md5 | 7df1049cbd56c0bfa4a3364a379b4c2c | MD5 2d69812584269699fade26622e6490c5 Stage one loader. MD5 7df1049cbd56c0bfa4a3364a379b4c2c Stage one loader. MD5 9f15fe9c4415cd668334339f705b94d8 Stag |
| md5 | 8dc8561349d144d4661bc66f2ec49f9f | stealer. MD5 fc3ba5ed282d77127efd0b0f2403531b Backdoor. MD5 8dc8561349d144d4661bc66f2ec49f9f Auxiliary autorun tool. URL hxxps://toria[.]app/ Fake walle |
| md5 | 8e84b01d5ac9624f0b181ade0e737193 | 5 781ce50001d4b449600afa347c9b0208 Stage three dropper. MD5 8e84b01d5ac9624f0b181ade0e737193 Stage three dropper. MD5 980e2134679bc0c609f7659882883d77 S |
| md5 | 980e2134679bc0c609f7659882883d77 | 5 8e84b01d5ac9624f0b181ade0e737193 Stage three dropper. MD5 980e2134679bc0c609f7659882883d77 Stage three dropper. MD5 4203ec932bfcc0907f91732440d6d997 S |
| md5 | 9a0043d900a9ac78c886c59c9a328fd0 | MD5 00d12d842596bf5ee1805effb4571d30 Stage six script. MD5 9a0043d900a9ac78c886c59c9a328fd0 Stage six script. MD5 7212229c85852c3bffaf9740002b2f39 Auxi |
| md5 | 9f15fe9c4415cd668334339f705b94d8 | MD5 7df1049cbd56c0bfa4a3364a379b4c2c Stage one loader. MD5 9f15fe9c4415cd668334339f705b94d8 Stage one loader. MD5 fb90887592655a8c989e443c640167aa Stag |
| md5 | c53d0ea45dbc622afb7f16ea3eec78bc | 12229c85852c3bffaf9740002b2f39 Auxiliary repair script. MD5 c53d0ea45dbc622afb7f16ea3eec78bc Infostealer. MD5 fc3ba5ed282d77127efd0b0f2403531b Backdoor. |
| md5 | eb760d5c88f13f7ee0f8f86ba3407123 | 5 4203ec932bfcc0907f91732440d6d997 Stage three dropper. MD5 eb760d5c88f13f7ee0f8f86ba3407123 Stage three dropper. MD5 f9f70096aabb4d22a6657014f4853a53 S |
| md5 | f97d24212fa6a21be0c4d211e10f044c | D5 3deeed48fd38f22e369f5c3092bd68a1 Stage four dropper. MD5 f97d24212fa6a21be0c4d211e10f044c Stage five script. MD5 00d12d842596bf5ee1805effb4571d30 Sta |
| md5 | f9f70096aabb4d22a6657014f4853a53 | 5 eb760d5c88f13f7ee0f8f86ba3407123 Stage three dropper. MD5 f9f70096aabb4d22a6657014f4853a53 Stage three dropper. MD5 3deeed48fd38f22e369f5c3092bd68a1 S |
| md5 | fb90887592655a8c989e443c640167aa | MD5 9f15fe9c4415cd668334339f705b94d8 Stage one loader. MD5 fb90887592655a8c989e443c640167aa Stage one loader. MD5 6791dad263cac6d63ebba6a4b57e7d71 Stag |
| md5 | fc3ba5ed282d77127efd0b0f2403531b | ript. MD5 c53d0ea45dbc622afb7f16ea3eec78bc Infostealer. MD5 fc3ba5ed282d77127efd0b0f2403531b Backdoor. MD5 8dc8561349d144d4661bc66f2ec49f9f Auxiliary au |
| sha256 | b8b4b88205a8f594b95a841bc37342898f34cad8a5a9e4a22ce69a31a1208650 | dstore[.]com Command-and-control address. HTTP access token b8b4b88205a8f594b95a841bc37342898f34cad8a5a9e4a22ce69a31a1208650 Observed value for the X-Upload-Token header. HTTP access t |
| sha256 | ff3ab9ef841630364818396f62e696b72aed162cf0b895b6643ef25dad79b51d | rved value for the X-Upload-Token header. HTTP access token ff3ab9ef841630364818396f62e696b72aed162cf0b895b6643ef25dad79b51d Observed value for the X-Upload-Token header. File artifact |
| url | http://caldav.icloud.com/published/2/MTk1NDMwMDMzNTUxOTU0M1aHCZ-nMxiyGzBTzPiodOf44DtKJ6PpjftAG28_ui2NCYMpL_vu4pF4ddsJ8ysg0QI7pR0VEIEbZYdilVZRw08 | c737d157ef4271/Helper.pkg.enc Encrypted helper package. URL hxxp://caldav.icloud[.]com/published/2/MTk1NDMwMDMzNTUxOTU0M1aHCZ-nMxiyGzBTzPiodOf44DtKJ6PpjftAG28_ui2NCYMpL_vu4pF4ddsJ8ysg0QI7pR0VEIEbZYdilVZRw08 Calendar URL shown in the infection-chain analysis. URL h |
| url | https://caldav.icloud.com/published/2/MTk1NDMwMDMzNTUxOTU0M1aHCZ-nMxiyGzBTzPiodOf44DtKJ6PpjftAG28_ui2NCYMpL_vu4pF4ddsJ8ysg0QI7pR0VEIEbZYdilVZRw08 | w08 Calendar URL shown in the infection-chain analysis. URL hxxps://caldav.icloud[.]com/published/2/MTk1NDMwMDMzNTUxOTU0M1aHCZ-nMxiyGzBTzPiodOf44DtKJ6PpjftAG28_ui2NCYMpL_vu4pF4ddsJ8ysg0QI7pR0VEIEbZYdilVZRw08 Calendar URL listed in the report’s IoCs. URL hxxps://gat |
| url | https://docsend.appstore.com.mx | tQgTQ0ULFxCanei3Ke-EuEyQL iCloud archive attachment. C2 URL hxxps://docsend.appstore[.]com[.]mx Command-and-control address. C2 URL hxxps://toria.apple |
| url | https://docsend.appstore.com.mx/dcc737d157ef4271/CoreUpdate.pkg.enc | cc737d157ef4271/stage2.enc Encrypted stage-two payload. URL hxxps://docsend.appstore.com[.]mx/dcc737d157ef4271/CoreUpdate.pkg.enc Encrypted package. URL hxxps://docsend.appstore.com[.]mx/ |
| url | https://docsend.appstore.com.mx/dcc737d157ef4271/Helper.pkg.enc | /dcc737d157ef4271/CoreUpdate.pkg.enc Encrypted package. URL hxxps://docsend.appstore.com[.]mx/dcc737d157ef4271/Helper.pkg.enc Encrypted helper package. URL hxxp://caldav.icloud[.]com/ |
| url | https://docsend.appstore.com.mx/dcc737d157ef4271/stage2.enc | 3c1a6b00bc31e14/stage2.enc Encrypted stage-two payload. URL hxxps://docsend.appstore.com[.]mx/dcc737d157ef4271/stage2.enc Encrypted stage-two payload. URL hxxps://docsend.appstore |
| url | https://gateway.icloud.com/caldav/1_MTk1NDMwMDMzNTUxOTU0M0pybtJB186GzhogprwCQUjY3oZNiDFHH8WVo6bmgUtI/attach/4GE4TKNBTGAYDGMZVGUYTSNJUGOAALDAFMDOJBGWNUCYJLZRNDCLCO2YMQ3I64RLGMNXVG3KYBPWQOGYIEI7MPBDDYHECFDYVENTXIYFNDCPOVRMCTYI236RCYZAE63V5U3RTUYGUMO2CO7PKCLWMCXE73M7OPTHSGRWH5DXQ4PCUQU4ELZTLW54JSTK2H7VQ6PD26WOA2R7PPIQ6RTJWDEWP34U3HB4YWMXXC6EJ6PKWILSPYRSDEVY6QGMWSIUN6PR5W35KO3D4QZE7CFPUVBAEKI/Loader.app.tar.gz/YXR0YWNoYXR0YWNoYXR0YRhrE8mQ0E-b_dTUSGStQgTQ0ULFxCanei3Ke-EuEyQL | EbZYdilVZRw08 Calendar URL listed in the report’s IoCs. URL hxxps://gateway.icloud[.]com/caldav/1_MTk1NDMwMDMzNTUxOTU0M0pybtJB186GzhogprwCQUjY3oZNiDFHH8WVo6bmgUtI/attach/4GE4TKNBTGAYDGMZVGUYTSNJUGOAALDAFMDOJBGWNUCYJLZRNDCLCO2YMQ3I64RLGMNXVG3KYBPWQOGYIEI7MPBDDYHECFDYVENTXIYFNDCPOVRMCTYI236RCYZAE63V5U |
| url | https://slack.apple03cloudstore.com/installer.sh | pstore.com[.]mx/installer.sh Installer script location. URL hxxps://slack.apple03cloudstore[.]com/installer.sh Installer script location. URL hxxps://toria.apple03cloud |
| url | https://streamyard.appstore.com.mx/installer.sh | arpcast[.]asia/Toria.dmg Malicious disk-image location. URL hxxps://streamyard.appstore.com[.]mx/installer.sh Installer script location. URL hxxps://slack.apple03cloud |
| url | https://toria.app/ | dc8561349d144d4661bc66f2ec49f9f Auxiliary autorun tool. URL hxxps://toria[.]app/ Fake wallet website. URL hxxps://warpcast[.]asia/Toria.dm |
| url | https://toria.apple03cloudstore.com | end.appstore[.]com[.]mx Command-and-control address. C2 URL hxxps://toria.apple03cloudstore[.]com Command-and-control address. HTTP access token b8b4b88205 |
| url | https://toria.apple03cloudstore.com/ | loudstore[.]com/installer.sh Installer script location. URL hxxps://toria.apple03cloudstore[.]com/ Reported malicious URL. URL hxxps://waaako.appstore.com[. |
| url | https://toria.apple03cloudstore.com/e3c1a6b00bc31e14/stage2.enc | pstore.com[.]mx/installer.sh Installer script location. URL hxxps://toria.apple03cloudstore[.]com/e3c1a6b00bc31e14/stage2.enc Encrypted stage-two payload. URL hxxps://docsend.appstore |
| url | https://waaako.appstore.com.mx/installer.sh | /toria.apple03cloudstore[.]com/ Reported malicious URL. URL hxxps://waaako.appstore.com[.]mx/installer.sh Installer script location. URL hxxps://toria.apple03cloud |
| url | https://warpcast.asia/Toria.dmg | run tool. URL hxxps://toria[.]app/ Fake wallet website. URL hxxps://warpcast[.]asia/Toria.dmg Malicious disk-image location. URL hxxps://streamyard.app |
From the original article
5 min read at cybersecuritynews.com
MacSync, a fast-changing macOS information stealer, has returned with a more complex delivery chain aimed at people who use cryptocurrency and developer tools. Instead of relying mainly on a pasted Terminal command, the latest activity begins with malicious disk-image files that pose as real applications. Operators can vary delivery between campaigns.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.