MacSync macOS Infostealer Adopts Binary Droppers and iCloud Staging

What Happened

The MacSync infostealer—a malware-as-a-service (MaaS) family initially tracked as Mac.c—has received a significant architectural overhaul. Threat actors are now employing compiled binary droppers written in Objective-C and Swift, moving away from the earlier AppleScript-based delivery mechanisms. Recent campaigns observed in the wild leverage malicious Apple Disk Image (DMG) files disguised as cracked applications or legitimate software, such as the nonexistent "Toria" crypto wallet promoted on social media and messaging platforms.

Technical Details

The updated infection chain features increased complexity, utilizing multi-stage loaders to evade basic endpoint detection. Depending on the specific campaign variant, the initial DMG payload either executes a compiled JavaScript for Automation (JXA) script that decodes a fileless shell script, or initiates a sequence of compiled loaders. Notably, operators have incorporated cloud infrastructure—specifically abusing Apple's iCloud service—to stage and deliver subsequent malicious modules to the target host.

Impact

MacSync primarily targets cryptocurrency enthusiasts and software developers. The malware functions as a dual-purpose threat, combining traditional credential and information-stealing capabilities with a dedicated backdoor module that grants persistent access to compromised macOS endpoints. Security telemetry detects these variations under generic heuristics, including HEUR:Trojan.OSX.MacSync.* and HEUR:Trojan-Dropper.OSX.MacSync.*.

What to Do

• Audit endpoint detection rules to ensure visibility into suspicious execution chains involving JXA scripts, compiled Objective-C/Swift binaries, and unusual outbound connections to cloud storage providers like iCloud.
• Block installation of unverified DMG files, particularly those sourced from social media advertisements, messaging channels, or cracked software repositories.
• Educate developers and cryptocurrency asset holders on targeted social engineering tactics, such as fake software distribution sites and utility applications.
• Verify that endpoint security agents are configured to detect and block known heuristic signatures associated with the MacSync malware family.