24-09-2026
MacSync under the microscope: new delivery methods and a new payload
https://securelist.com/macsync-new-version/121383/
Report completeness: Low
Threats:
Macc_stealer
Amos_stealer
Clickfix_technique
Pamstealer
Mitm_technique
Victims:
Software developers, Cryptocurrency users, Information technology users
TTPs:
Tactics: 1
Technics: 0
ChatGPT TTPs:
do not use without manual checkT1005, T1027, T1027.009, T1027.013, T1036.005, T1041, T1056.002, T1057, T1059.002, T1059.004, have more...
IOCs:
Url: 14
File: 2
Hash: 21
Soft:
Telegram, sysctl, macOS, Kubernetes, Chrome, appstore
Wallets:
ledger_wallet
Algorithms:
sha256, aes, curve25519-donna, ecdh, zip, cbc, xor, base64, curve25519
Languages:
applescript, objective_c, swift
Platforms:
intel, apple
Links:
https://github.com/agl/curve25519-donna