Malware
MacSync Stealer: Six‑Stage macOS RAT Reverse‑Engineered – Defender Actions
The MacSync RAT, a six‑stage macOS infostealer, was reverse‑engineered after an infected host was taken offline. Attackers used the tool to exfiltrate credentials and maintain persistence. Defenders should monitor for its unique persistence modules, block known download URLs, and harden MacOS with the latest security updates.
What happened
Huntress recovered the MacSync RAT from an attacker’s infrastructure after a victim’s macOS host was isolated. Reverse engineering revealed a six‑stage pipeline that installs a stealthy payload, harvests credentials, and exfiltrates data.
Impact
MacSync targets macOS systems, leveraging built‑in services to evade detection. The tool can steal Safari and Keychain credentials, inject persistence scripts, and create remote shells for lateral movement.
What to do
- Deploy endpoint detection and response that flags the MacSync binary and its associated network traffic.
- Block known download URLs and domains identified during the reverse‑engineering effort.
- Ensure macOS is patched to the latest security release and disable unnecessary services that the RAT exploits.
- Implement strict application whitelisting and monitor for unauthorized changes to launch agents and daemons.
- Conduct a forensic review of affected hosts to confirm persistence mechanisms and remove any residual components.
Technical Notes
MacSync’s six stages include: (1) initial download, (2) extraction, (3) credential harvesting, (4) persistence injection, (5) command‑and‑control communication, and (6) data exfiltration. Each stage uses obfuscated binaries and encrypted payloads.
Related articles
MacSync macOS Infostealer Adopts Binary Droppers and iCloud Staging
Security researchers have detailed an updated campaign involving the MacSync macOS infostealer and backdoor, targeting crypto users and developers. The latest variant abandons script-based droppers in favor of compiled Objective-C and Swift binaries, leveraging iCloud for payload delivery during multi-stage infections.
Read briefing
ClearFake Campaign Uses WebDAV and Fake CAPTCHA Lures to Deploy Amatera Stealer
Cybersecurity researchers have uncovered a new ClearFake infection campaign that leverages fake Google CAPTCHA prompts and WebDAV shares to distribute the Amatera information stealer. The multi-stage attack tricks users into running malicious commands, resulting in the deployment of secondary payloads such as ZigCryptoStealer, a Go-based reverse proxy, and unauthorized instances of NetSupport Manager. Activity targeting a Ukrainian government organization has been linked to a threat cluster tracked as UAT-10820.
Read briefing
Android RAT Hirudo Replaces Banking Apps with Trojanized Copies
A new Android RAT, Hirudo, drops trojanized copies of banking apps to bypass security controls, targeting eight Indonesian banks and potentially others. Defenders should block suspicious app downloads, monitor for unknown RATs, and enforce app vetting.
Read briefing
ClickFix Campaign in Ukraine Deploys Lunex Infostealer via Fake Cloudflare Pages
Over 100 Ukrainian websites were hijacked to serve a counterfeit Cloudflare verification page that prompted users to run a PowerShell command. The command installed Lunex Stealer, an infostealer that also installs the LunarAxe browser extension and NaiveMess component, giving attackers credential theft and remote control. Defenders should block malicious domains, monitor for Lunex signatures, and educate users against executing unknown scripts.
Read briefing