Hackers Use ClickFix Lures to Deploy MacSync Stealer and Bypass macOS Security.
ClickFix malvertising campaigns deliver MacSync, a macOS infostealer sold as MaaS that bypasses Gatekeeper via Terminal commands and steals credentials.
Threat actors use ClickFix social-engineering lures, SEO poisoning, and malvertising impersonating brands like Claude, ChatGPT, Zoom, and Docker to trick users into pasting curl-to-zsh commands into Terminal, evading Gatekeeper and notarization checks. The MacSync Stealer (formerly Mac.c, emerged April 2025, linked to developer 'Mentalpositive') is a 64-bit Mach-O stager with single-byte XOR string obfuscation that daemonizes, polls C2 with custom API-key headers, streams AppleScript payloads into osascript, and persists via fake LaunchAgents. It steals browser credentials, Keychain data, SSH keys, session tokens, and crypto wallets, exfiltrating archives in 10MB HTTP PUT chunks. Microsoft documented more than 30 related MacSync domains.
- Victims manually paste curl-to-zsh commands, sidestepping Gatekeeper and notarization checks
- Stager daemonizes, XOR-obfuscates strings, and streams AppleScript payloads from C2 via osascript
- Exfiltrates staged archives in 10MB HTTP PUT chunks; persists via masquerading LaunchAgents
- Linked to theft of browser credentials, Keychain data, SSH keys, and cryptocurrency wallets
- Microsoft identified over 30 related MacSync domains through behavioral pivoting
- ATT&CK
- T1566.002 Spearphishing LinkT1059.004 Unix ShellT1543.004 Launch AgentT1027 Obfuscated Files or InformationT1041 Exfiltration Over C2 Channel
- Products
- MacSync
- Malware
- MacSync Stealer
- Organizations
- ClickFix
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 9678f71ea4cccbc3d511dc8d7f24b113 | b68aeadc44eeb97c9aab11 Native Mach-O Stager Binary MD5 Hash 9678f71ea4cccbc3d511dc8d7f24b113 Native Mach-O Stager Binary SHA-1 Hash 59508d071661ea70fa5f |
| sha1 | 59508d071661ea70fa5fcbe6f9e2fb72506e57df | cbc3d511dc8d7f24b113 Native Mach-O Stager Binary SHA-1 Hash 59508d071661ea70fa5fcbe6f9e2fb72506e57df Native Mach-O Stager Binary Code Signing ID com.utils.Launc |
| sha1 | d182eb7cba0ffa42d770d7b0d3499e49f24163a2 | om.utils.Launcher Ad-hoc signature bundle identifier CDHash d182eb7cba0ffa42d770d7b0d3499e49f24163a2 Code Directory Hash Note: IP addresses and domains are inte |
| sha256 | 9ff32f7c0108e9d27a3b491edf04827b6ca025f44db68aeadc44eeb97c9aab11 | stores. IOCs Indicator Type Value Description SHA-256 Hash 9ff32f7c0108e9d27a3b491edf04827b6ca025f44db68aeadc44eeb97c9aab11 Native Mach-O Stager Binary MD5 Hash 9678f71ea4cccbc3d511dc |
From the original article
4 min read at gbhackers.com
Threat actors are increasingly using ClickFix social-engineering lures and search-engine malvertising to deploy MacSync Stealer, a macOS-focused information stealer and remote-access staging framework sold through a malware-as-a-service model.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.