We first spotted it in the wild in September 2026: a retooled MacSync campaign that abandons script-only droppers for compiled binaries, delivers modules written in Objective-C and Swift, and uses Apple infrastructure as an intermediate transport.
How the new MacSync surfaced in September 2026
MacSync is a young but rapidly evolving family of crypto/info stealers that was first advertised on the dark web in 2025 as “Mac.c” and later renamed by its creators. In the samples observed in September 2026 the operators replaced AppleScript droppers with FAT Mach‑O binaries that run on both Apple silicon and Intel macOS hosts. Kaspersky products detect these samples under the verdicts HEUR:Trojan.OSX.MacSync.*, HEUR:Trojan-PSW.OSX.MacSync.*, HEUR:Trojan-Dropper.OSX.MacSync.* and HEUR:Trojan-Downloader.OSX.MacSync.*.
Delivery and infection chain: DMG, two dropper paths, and an iCloud calendar trick
The campaign begins with malicious DMG images that present as fake or cracked applications (the researchers found one masquerading as a nonexistent crypto wallet called “Toria”). Within a single campaign the attackers used two distinct delivery methods: one DMG contained a compiled JXA script that decodes and streams a shell script directly to the interpreter without writing it to disk; the other DMG launches a chain of binary droppers and loaders.
In the multi-stage chain the first .APP checks for the com.apple.quarantine attribute and runs xattr -cr <app_name> to clear it. The app reads an XOR‑encrypted URL embedded in its binary overlay — the ciphertext is followed by an 8‑byte length and the magic word SONOMAC1; the overlay is read backwards to locate the magic word and determine the ciphertext boundaries. At least one decrypted URL pointed to a public iCloud calendar (the advisory reproduces the calendar URL). The downloaded calendar is fed line‑by‑line into zsh -s via an anonymous pipe; normal calendar lines are ignored until the DESCRIPTION: line, which contains a script that downloads a .TAR.GZ from iCloud containing an .APP bundle. That bundle is unquarantined, signed with an ad‑hoc signature and executed.
Across stages the malware consistently uses /tmp for temporary files, creates *.lock files to prevent re‑execution, and removes temporary files and logs after completing tasks.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildpkgunpack, Curve25519 ECDH and layered encrypted payload delivery
At a later stage the campaign switches from simple XOR/AES schemes to a custom utility called pkgunpack with genkey and decrypt commands. Genkey uses an open Curve25519 implementation (curve25519_donna) to generate a Curve25519 key pair. The victim’s public key (base64) and a one‑time code ($(date +%s)-${{RANDOM}}-$$) are sent to the server; the server responds with JSON containing a base64‑encoded wrapped key (dek_wrap_b64), a server public key (build_pub_b64 = "pFSxn/Uwg9bS45aVKCzA+8exSMfDHXpbpHC/f7G472w=") and "crypto":"v2.5".
Decrypt computes a shared secret from the server’s known public key and the session private key (Curve25519 ECDH), concatenates the secret with the literal string "sn-dek-wrap-v1", and hashes the result with SHA‑256 to derive an AES‑GCM key. dek_wrap_b64 decodes into a header with 5 bytes of additional authenticated data (AAD), 12 bytes of IV, and the remaining ciphertext; decrypt uses AES‑GCM with those parameters to recover the payload decryption key. The downloaded payload itself contains an AAD and IV and is decrypted with AES‑GCM. Observers noted the utility zeros buffers after use to impede forensic recovery.
Infostealer, backdoor, persistence mechanics and C2 behavior
The infostealer ships as an .APP whose main executable is written in Swift. It prompts the user for an administrator password and tailors the UI to the app it impersonates. Notably, the stealer validates passwords via the PAM API rather than the more common dscl approach — a technique the authors observed recently in other macOS malware samples.
The stealer harvests: browser data (history, cookies, saved logins, Local State), crypto wallet extension data, saved passwords, Telegram data, device login/password, Keychain files, system inventory, SSH/ZSH/AWS/Kubernetes/GIT configuration files, shell histories, and the current user profile picture. A disabled feature in all samples examined would, if enabled, attempt to run a helper named KcHelper or else invoke a fallback that modifies a keychain entry’s partition_id via security set-generic-password-partition-list and then uses Security.framework to retrieve secrets.
The backdoor is a Fat Mach‑O written in Objective‑C. It disguises itself as Finder, establishes persistence by creating a LaunchAgent named com.apple.finder.agent, injecting a command to run a .repair-run script into ~/.zshrc and global GIT hooks, and placing files under $HOME/Library/Application Support/System. The .repair-run script restores backdoor files from backup and kills BTMNotificationAgent, NotificationCenter and BackgroundTaskManagementAgent to suppress system notifications.
Command-and-control traffic occurs over HTTP and expects JSON responses. Endpoints include /v1/agent/ping, /v1/agent/refresh, /v1/asset/<upload_id>/init and /v1/asset/<upload_id> for PUT uploads. File uploads are initialized with X-File-Size and X-File-Sha256 headers and sent in parts. The backdoor executes AppleScript payloads delivered in a base64 script_b64 field and supports commands named deploy_ext, deploy_ledger, regrab and live_browser. The campaign requires a custom HTTP header X-Upload-Token (observed tokens include b8b4b88205a8f594b95a841bc37342898f34cad8a5a9e4a22ce69a31a1208650 and ff3ab9ef841630364818396f62e696b72aed162cf0b895b6643ef25dad79b51d).
What this means for technologists and security teams, developers and crypto users, and enterprise procurement leaders
- Technologists and security teams: watch for binary droppers that clear com.apple.quarantine (xattr -cr), executables unpacking to /tmp/.sys-*, the .repair-run script and LaunchAgent com.apple.finder.agent, ZSH and Git hook persistence, and the observed X-Upload-Token header and token values.
- Developers and crypto users: MacSync specifically harvests developer configuration files (SSH, GIT, Kubernetes) and crypto-related data (wallet extensions, Ledger‑replacement capability "deploy_ledger"), making developer workstations and crypto tooling high‑value targets in this campaign.
- Enterprise procurement and IT leaders: the shift from script droppers to signed, compiled Swift/Objective‑C binaries and use of Apple infrastructure as a transport increases the sophistication of delivery; compromises of developer machines could materially expand attacker access to code and build systems.
MacSync’s September 2026 variants show a clear evolution: compiled macOS binaries, layered cryptographic delivery using Curve25519 ECDH and AES‑GCM, and a backdoor that integrates multiple persistence and data‑exfiltration mechanisms. Defenders will need to look for the specific behavioral markers documented here — and for the operational tradecraft, like use of ad‑hoc signing and iCloud transport, that helps this family blend with legitimate macOS activity.
