MacSync macOS stealer returns with binary droppers, iCloud calendar staging and a backdoor targeting crypto users and developers

Linha do tempo

1. securelist.com ↗ · pub. 24/09/2026 07:00 · coletado 19/10 17:56 primeiro registro

   MacSync macOS stealer returns with binary droppers, iCloud calendar staging and a backdoor targeting crypto users and developers

   ler a análise desta fonte ocultar

   Kaspersky researchers describe a new MacSync macOS infostealer variant, first seen in the wild in September 2026, that replaces the earlier AppleScript-based droppers with FAT Mach-O binaries written in Objective-C and Swift. MacSync is sold as malware-as-a-service, so delivery varies by operator. In this campaign it spread through malicious DMG images posing as a nonexistent crypto wallet app called Toria, promoted on X and Telegram. The multi-stage chain stages payloads through a public iCloud calendar and iCloud-hosted archives, then installs a stealer and a persistent backdoor. The data collected and the lures used indicate that developers, crypto enthusiasts and other IT and crypto users are the primary targets.

   Technical Details

   • Stage one: the DMG contains an .APP that removes the quarantine attribute with xattr -cr. It decrypts an XOR-encrypted URL from its overlay (magic word SONOMAC1, key 73 6f 6e 6f 6d 61 62 6c 64 07). A second variant uses a compiled JXA script that runs a shell script in memory.
   • Stage two: the URL points to an attacker server or a public iCloud calendar. The downloader pipes the calendar line by line into zsh -s. The malicious commands sit after the DESCRIPTION: line and fetch a .TAR.GZ containing an .APP, which is de-quarantined, ad-hoc signed and run.
   • Stages three and four: AES-CBC-encrypted droppers extract to /tmp/.sys-<16 digits>. The second dropper adds anti-analysis checks (kern.hv_vmm_present, machdep.cpu.brand_string, ptrace PT_DENY_ATTACH).
   • Later stages: the script is executed in memory. It uses the custom pkgunpack utility (genkey/decrypt) with ECDH Curve25519 (curve25519_donna), a SHA-256 key derivation using the string sn-dek-wrap-v1, and AES-GCM to decrypt the stealer and backdoor modules. Familiar MacSync traits include daemon_function, 90 MB PUT uploads and a /loader/ URL path. The C2 requires an X-Upload-Token header.
   • Stealer: a Swift .APP that prompts for the admin password under a fake corrupted-app notification and validates it through the PAM API rather than dscl. It collects browser data, crypto wallet data, SSH/ZSH/AWS/Kubernetes/GIT configs, shell history and system information, staged in a hidden directory under /tmp/. A currently disabled keychain feature (KcHelper / _kc_grab_storage_item) modifies partition_id to read browser secrets without a prompt.
   • Backdoor: an Objective-C binary (build BLD-150) that disguises itself as Finder. Persistence uses a LaunchAgent named com.apple.finder.agent, .ZSHRC injection, and global GIT pre-commit and post-checkout hooks that call .repair-run. That script restores the files and kills BTMNotificationAgent, NotificationCenter and BackgroundTaskManagementAgent to suppress persistence alerts. All backdoor commands execute base64 AppleScript from the C2: deploy_ext, deploy_ledger, regrab, and live_browser (downloads sn_relay, likely browser traffic MitM). Logs go to $HOME/Library/Logs/.sysnotif-agent.log.

   Remediation

   • Detect and block the Kaspersky verdicts HEUR:Trojan.OSX.MacSync.*, HEUR:Trojan-PSW.OSX.MacSync.*, HEUR:Trojan-Dropper.OSX.MacSync.* and HEUR:Trojan-Downloader.OSX.MacSync.*.
   • Block the listed domains and URLs, and hunt for the com.apple.finder.agent LaunchAgent, $HOME/Library/Application Support/System, .repair-run, and unexpected entries in .zshrc and global GIT hooks.
   • Treat any host where such software was run as compromised: rotate credentials, SSH/cloud keys and wallet secrets, and move crypto assets.
   • Warn developers and crypto users against installing unofficial or cracked applications from DMG images.