MacSync under the microscope: new delivery methods and a new payload
September 24, 2026 · Kaspersky (Securelist) · Severity: MEDIUM
This article examines the evolution of the MacSync infostealer family, highlighting a new infection chain that replaces script-based droppers with binary ones and uses iCloud for payload delivery. The malware now features modules written in Objective-C and Swift, and is distributed under a malware-as-a-service model. Kaspersky provides detection verdicts for the various components. 📌 **Analyst Note:** The shift to binary droppers and iCloud delivery indicates increasing sophistication in macOS malware, making detection harder. Defenders should monitor for unusual iCloud activity and update endpoint detection rules for MacSync variants.
MacSync is a relatively young, rapidly evolving family of crypto/info stealers. First advertised on the dark web in 2025 as Mac.c, the stealer was later renamed to MacSync by its creators. The initial versions were implemented as AppleScripts and closely resembled the AMOS stealer family, but over time, MacSync developed distinctive features of its own, including a backdoor module. In this report, we discuss a new infection chain that differs significantly from previous variants. We first spotted it in the wild in September 2026.
Key points:
- The developers of this family have overhauled their approach to payload delivery by replacing script-based droppers with binary ones.
- The main malicious payload now consists of modules written in Objective-C and Swift.
- At one stage of infection, the attackers use iCloud to deliver the next
Kaspersky solutions detect the threats described below under the following verdicts:
- HEUR:Trojan.OSX.MacSync.*
- HEUR:Trojan-PSW.OSX.MacSync.*
- HEUR:Trojan-Dropper.OSX.MacSync.*
- HEUR:Trojan-Downloader.OSX.MacSync.*
Technical details
Infection chain
MacSync is an infostealer distributed under the malware-as-a-service (MaaS) model, so the specific delivery method for the first stage of the infection chain is up to the operators. Recent public reports on MacSync have mostly focused on modules delivered through social engineering and ClickFix-style attacks. However, both then and now, the malware has also spread disguised as free or cracked versions of popular applications, as well as under the guise of new software. For example, we found MacSync masquerading as a nonexistent crypto wallet app called Toria; the attackers not only created a dedicated web page for it but also promoted it on X and Telegram:
The latest version of the infostealer we discovered starts the infection chain with malicious DMG images. Even within a single campaign built around one fake application, we found two different ways the infostealer and backdoor modules were delivered to the victim’s device. In one, the payload inside the DMG was a compiled JXA script that, once launched, decoded a shell script and passed it directly to the interpreter without writing it to disk. In the other version of the application, the same script appeared at a later stage of infection, after a chain of droppers and loaders had run. We’ll take a look at the second infection chain in detail, since it is more complex and technically interesting. The infection scheme is shown below:
It’s worth noting right away that MacSync shows shared traits at almost every stage:
- All temporary files are placed in the /tmp directory. The same directory is where *.lock files are created to prevent the malware from running again.
- Once its task is complete, the module removes traces of its activity: temporary files, its own logs, and so on.
- All binary files are in the FAT Mach-O format and target devices with both Apple and Intel processors.
Loader, Calendar, and Two Simple Droppers
In this infection chain, the payload on the disk image is an .APP application. When started, it first checks whether the whole bundle has the com.apple.quarantine extended quarantine attribute, and if it finds one, it runs the xattr -cr <app_name> command to remove all attributes. Next, it extracts an XOR-encrypted URL from its overlay and decrypts it with the key 73 6f 6e 6f 6d 61 62 6c 64 07. After the encrypted data, there are 8 bytes indicating the length of the ciphertext, followed by the magic word SONOMAC1. It’s worth noting that the malware reads the overlay backwards: it first locates the magic word, then reads the data size, and then uses the size to determine the boundaries of the data block containing the ciphertext.
