MacSync under the microscope: new delivery methods and a new payload
AI summary · glm-5.3Summaries by Vani AI
MacSync, a crypto/info stealer with a backdoor module, was spotted in the wild in September 2026 with new binary payload delivery methods.
MacSync, a crypto/info stealer, has been observed in the wild in September 2026, featuring a backdoor module and new infection chains using binary payloads and MaaS delivery models.
Key facts
- MacSync is a crypto/info stealer with a backdoor module.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | icloud.com | e link pointed to a public iCloud calendar: 1 hxxp://caldav.icloud[.]com/published/2/MTk1NDMwMDMzNTUxOTU0M1aHCZ-nMxiyGzBTzPiodOf44 |
| md5 | 09425f72de8bba18893dcd6f04115891 | 112d3215c5d184689fc836e0dc6c1a47e42c34e70b2c3d356864bc4cb4c 09425f72de8bba18893dcd6f04115891 A couple more scripts Inside the retrieved script, we can i |
| md5 | 3a1af2b397c6958e6c3ba3c75912d60e | f86cabde4f8cee2d3cdec370c623bfa6c2b72ae9750fc9a7b299c65d7ca 3a1af2b397c6958e6c3ba3c75912d60e The dropper decrypts and unpacks it, then places it at /tmp |
| md5 | 8d371f8a7a6dcc2655544ae13cbca03d | 975113dfc552df982dcae699f9154a448e05a743bdfb641a463352bc13a 8d371f8a7a6dcc2655544ae13cbca03d Payload of the second dropper As shown in the screenshot ab |
| sha256 | 3744f975113dfc552df982dcae699f9154a448e05a743bdfb641a463352bc13a | ode, using the following key and initialization vector: 1 2 3744f975113dfc552df982dcae699f9154a448e05a743bdfb641a463352bc13a 8d371f8a7a6dcc2655544ae13cbca03d Payload of the second drop |
| sha256 | b8b4b88205a8f594b95a841bc37342898f34cad8a5a9e4a22ce69a31a1208650 | our research, we observed the use of the following tokens: b8b4b88205a8f594b95a841bc37342898f34cad8a5a9e4a22ce69a31a1208650 and ff3ab9ef841630364818396f62e696b72aed162cf0b895b6643ef25 |
| sha256 | cb09ff86cabde4f8cee2d3cdec370c623bfa6c2b72ae9750fc9a7b299c65d7ca | ode, using the following key and initialization vector: 1 2 cb09ff86cabde4f8cee2d3cdec370c623bfa6c2b72ae9750fc9a7b299c65d7ca 3a1af2b397c6958e6c3ba3c75912d60e The dropper decrypts and u |
| sha256 | ff3ab9ef841630364818396f62e696b72aed162cf0b895b6643ef25dad79b51d | 5a8f594b95a841bc37342898f34cad8a5a9e4a22ce69a31a1208650 and ff3ab9ef841630364818396f62e696b72aed162cf0b895b6643ef25dad79b51d . The backdoor later uses these same tokens to communicate |
| sha256 | ff664112d3215c5d184689fc836e0dc6c1a47e42c34e70b2c3d356864bc4cb4c | initialization vector, and then executes it in memory: 1 2 ff664112d3215c5d184689fc836e0dc6c1a47e42c34e70b2c3d356864bc4cb4c 09425f72de8bba18893dcd6f04115891 A couple more scripts Insi |
| url | http://caldav.icloud.com/published/2/MTk1NDMwMDMzNTUxOTU0M1aHCZ-nMxiyGzBTzPiodOf44DtKJ6PpjftAG28_ui2NCYMpL_vu4pF4ddsJ8ysg0QI7pR0VEIEbZYdilVZRw08 | one sample, the link pointed to a public iCloud calendar: 1 hxxp://caldav.icloud[.]com/published/2/MTk1NDMwMDMzNTUxOTU0M1aHCZ-nMxiyGzBTzPiodOf44DtKJ6PpjftAG28_ui2NCYMpL_vu4pF4ddsJ8ysg0QI7pR0VEIEbZYdilVZRw08 Contents of the downloaded calendar After retrieving the |
From the original article
13 min read at securelist.com
We look at a new version of the MacSync macOS stealer with a backdoor module that targets crypto enthusiasts and developers.
By Sergey Puzan · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.