MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
A malvertising campaign spreads a macOS infostealer called MacSync via sponsored Google search results that lead to a legitimately hosted claude.ai shared conversation page impersonating Apple Support. The page uses a ClickFix technique to trick victims into pasting a curl command into Terminal, triggering a six-stage attack chain: a zsh loader, in-memory payload execution, a server-generated AppleScript stealer, a Mach-O remote access trojan, a helper for stealing Screen Recording TCC permissions, and trojanized crypto wallet apps. The malware harvests browser cookies, keychain secrets, SSH/cloud keys, Telegram sessions, and crypto recovery phrases, while using C2 over WebSocket/TLS and XOR-obfuscated fallback domains for persistence.
Table of contents
Sponsored search results aren't always just annoying adsReverse engineering MacSync StealerRewinding back to the initial access lureQuestions this post answers
What is the ClickFix technique used to distribute macOS malware like MacSync Stealer?
ClickFix is a social engineering tactic where attackers trick victims into copying and pasting a malicious command into their Terminal, often via a fake but legitimately hosted page, such as a publicly shared Claude conversation on claude.ai impersonating Apple Support. The pasted curl command with a zsh loader kicks off a multi-stage infection chain without the victim realizing what is happening. Security teams tracking social engineering trends like ClickFix can follow emerging techniques on daily.dev.
What data does MacSync Stealer malware collect from an infected Mac?
MacSync collects browser cookies and logins, keychain secrets, account passwords, Telegram sessions, SSH and cloud keys, and cryptocurrency recovery phrases. It extracts Chromium Safe Storage AES keys from the login keychain to decrypt stolen cookies and saved logins, and also installs a persistent Mach-O RAT for full remote access and screen recording capture. Anyone hardening endpoint defenses against infostealers can track threat writeups like this on daily.dev.
How does MacSync Stealer maintain persistence and command and control on macOS?
MacSync installs a Mach-O remote access trojan that builds a plist file and LaunchAgent to relaunch at every login, named after the first updater found on the host. It connects directly to a raw IP over WebSocket via TLS using its own embedded OpenSSL stack to bypass macOS trust checks, with a single-byte XOR-obfuscated fallback domain for resilience. Incident responders reverse engineering macOS RATs can find detailed breakdowns like this on daily.dev.