MacSync: The Evasive macOS Stealer Exploiting ClickFix Lures

MITRE Techniques

• [T1204.002 ] User Execution – Victims are tricked into running a Terminal command through ClickFix prompts (‘users are tricked into copying and running commands in Terminal under the guise of software installers, CAPTCHA checks, download errors, or troubleshooting prompts’).
• [T1059.002 ] AppleScript – The stager pipes remote content directly into osascript to execute an in-memory AppleScript payload (‘pipes the response directly into /usr/bin/osascript via stdin’).
• [T1059.004 ] Unix Shell – The infection chain uses shell commands such as curl and zsh to launch stages (‘curl -s … | zsh’).
• [T1543.001 ] Launch Agent – Persistence is established by placing a malicious plist in LaunchAgents (‘persists using the ~/Library/LaunchAgents/ directory’).
• [T1027 ] Obfuscated Files or Information – Strings, URLs, headers, and paths are hidden with single-byte XOR obfuscation (‘hide functional strings … using … ObfuscatedString’).
• [T1564.001 ] Hidden Files and Directories – Temporary artifacts are stored with dot-prefixed names (‘/tmp/.httpcode’).
• [T1070.004 ] File Deletion – The malware removes staging and status files after successful upload (‘deletes /tmp/osalogging.zip and /tmp/.httpcode’).
• [T1036.005 ] Masquerading – The signed binary uses a spoofed utility-style identifier to blend in (‘Signing Identifier com.utils.Launcher’).
• [T1562.001 ] Impair Defenses – It suppresses terminal output by redirecting standard streams to /dev/null (‘redirects stdin, stdout, and stderr to /dev/null’).
• [T1555.001 ] Credentials from Password Stores – The AppleScript steals Keychain data and stored credentials (‘steals all keychains data’).
• [T1539 ] Steal Web Session Cookie – The payload dumps browser session cookies for reuse (‘session cookies’).
• [T1552.004 ] Private Keys – The stealer targets SSH keys and other private credentials (‘SSH keys’).
• [T1082 ] System Information Discovery – The malware collects host details such as macOS version and hardware UUID (‘collects macOS version, hardware UUID, and CPU architecture’).
• [T1560.001 ] Archive Collected Data – Stolen data is bundled into a ZIP archive before exfiltration (‘archives stolen data into /tmp/osalogging.zip’).
• [T1071.001 ] Web Protocols – C2 communication uses HTTPS with custom headers (‘connects to C2 servers over HTTPS’).
• [T1105 ] Ingress Tool Transfer – The remote AppleScript payload is fetched from the server and executed (‘Downloads second-stage AppleScript modules’).
• [T1030 ] Data Transfer Size Limits – Large archives are split into 10 MB chunks for upload (‘splits files into 10 MB chunks’).
• [T1048.003 ] Exfiltration Over Alternative Protocol – Data is uploaded with HTTP PUT requests (‘uploads them sequentially via HTTP PUT requests’).