Last Updated: 2026-09-26T19:51:29Z
What’s Happening
Two new macOS-focused infostealers show overlaps in new (and also kinda very old) techniques.
New MacSync variants have been spotted in the wild just this month. It differs from previous versions, moving from AppleScript to Swift and Objective-C, as well as implementing a more complex infection chain.
While ClickFix techniques are still popular, MacSync has expanded to include droppers and loaders disguised as free or cracked versions of popular applications, and new (fake) software. Developers, crypto enthusiasts, and users related to IT or crypto space in some form seem to be the primary targets.
This move to Objective-C and Swift with continued use of JXA (JavaScript Automation) is present in other contemporaneous samples. Jamf reported this week about PamStealer, another JXA-using payload, that’s moved to Swift and Obj-C.
Actions
Due to the severe impact of compromised developer machines as seen in the recent Cargo attacks, it’s imperative your developers are not downloading cracked, pirated, bootleg, etc. software on any machine they are working from.
As always, review the IoCs for presence in your environment, and block/detect any associated network traffic.
JXA scripts should (need to test) trigger a TCC consent popup for the user, which is an education point for defense.
(One of these)
Observables
https://securelist.com/macsync-new-version/121383/#indicators-of-compromise
https://www.jamf.com/blog/pamstealer-wavel-macos-infostealer/#iocs:~:text=of%20similar%20threats.-,Indicators%20of%20compromise,-1
Notes
- Some samples downloaded stages from attacker-controlled servers, one (possibly more) from public iCloud calendars
- Like previous variants, new variants are after browser data, crypto wallet data, telegram data, credentials, keychains, system info, config files, shell history, and user account info
- Backdoor and persistence are much more robust than initial variants
