New Mac Malware 'MacSync' Stealing Crypto Wallets

TL;DR

A new macOS malware called 'MacSync Stealer' is targeting Apple users to steal cryptocurrency wallets and sensitive credentials. It employs deceptive tactics to trick users into providing their login information.

Key points

New macOS malware named 'MacSync Stealer' identified
Targets Apple users to steal cryptocurrency wallets
Uses deceptive social engineering tactics
Mimics legitimate macOS password prompts
Exfiltrates sensitive infrastructure credentials

Mentioned in this story

SlowMist

MacSync StealermacOSApple

Blockchain security firm SlowMist has warned about a highly destructive new macOS infostealer dubbed "MacSync Stealer" (v1.1.2).

The active malware campaign is specifically targeting Apple users to drain cryptocurrency wallets and exfiltrate highly sensitive infrastructure credentials.

The modus operandi

Deceptive social engineering tactics are used by malicious actors to bypass user defenses.

The malware uses fake AppleScript system dialogs that mimic legitimate macOS password prompts to phish for the user's login credentials.

The malware silently exfiltrates their data in the background once the victim takes the bait. MacSync Stealer displays a fake "not supported" error message immediately after the data extraction is complete in order not to raise any suspicion. The trick makes it seem like the application simply failed to launch.

Apart from cryptocurrency users, the malware is targeting browser credentials, macOS system Keychains, critical infrastructure keys, including SSH, AWS, and Kubernetes (K8s) credentials

Other MacOS-related incidents

This is not an isolated incident. Bybit's security team has just uncovered a malware campaign targeting macOS users searching for Claude Code.

Recently, Microsoft Threat Intelligence exposed a highly targeted macOS campaign orchestrated by "Sapphire Sleet," a known North Korean state-sponsored threat actor. Sapphire Sleet uses advanced social engineering to impersonate legitimate macOS software updates and steal cryptocurrency wallets.

One should also mention the "Infinity Stealer" malware, which demonstrated how Windows-centric attack methods are being adapted for macOS. It uses the "ClickFix" technique to present victims with a fake CAPTCHA page. Cybersecurity firm SOC Prime has also identified "MioLab," which is a commercially distributed macOS infostealer explicitly built to target high-value victims, including crypto holders.

Q&A

What is MacSync Stealer and how does it work?

MacSync Stealer is a macOS infostealer that uses fake AppleScript dialogs to phish for user login credentials and drain cryptocurrency wallets.

Who is at risk from the MacSync malware?

Apple users, particularly those with cryptocurrency wallets, are at risk from the MacSync malware campaign.

What tactics are used by the MacSync malware campaign?

The malware employs social engineering tactics, including deceptive prompts that mimic legitimate macOS password requests, to bypass user defenses.