CTI · corroborated · 2026-09-11

MacSync: The Evasive macOS Stealer Exploiting ClickFix Lures

Full story & timeline

MITRE ATT&CK

• T1204 User Execution Execution
• T1059 Command and Scripting Interpreter Execution
• T1555 Credentials from Password Stores Credential Access

Indicators

Observables tied to this case, from the curated feed. raw sidecar

• com.utils.launcher domain · expired

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: MacSync macOS Stealer Fork-to-Launchd Reparenting and XOR Configuration
id: b2c4d6e8-f0a1-4b3c-9d5e-7f8a0b2c4d6e
status: experimental
description: Detects MacSync macOS stealer behavior including fork-to-launchd reparenting, XOR-encoded configuration blobs, and credential harvesting module execution
references:
  - https://www.malware.news/
  - https://gbhackers.com/
author: Tia N. List
date: 2026-09-11
tags:
  - attack.execution
  - attack.t1204
  - attack.execution
  - attack.t1059
  - attack.credential-access
  - attack.t1555
logsource:
  product: macos
  category: process_creation
detection:
  selection_fork_setid:
    Image|endswith:
      - '/MacSync'
      - '/com.utils.launcher'
    CommandLine|contains:
      - 'setid'
      - 'setuid'
      - 'fork'
  selection_chrome_dump:
    Image|endswith:
      - '/MacSync'
      - '/com.utils.launcher'
    CommandLine|contains:
      - 'Chrome'
      - 'Firefox'
      - 'Safari'
      - 'Keychain'
      - 'Login'
  selection_xor_decode:
    Image|endswith:
      - '/MacSync'
      - '/com.utils.launcher'
    CommandLine|contains:
      - 'XOR'
      - 'decode'
      - 'decrypt'
      - 'config'
  condition: selection_fork_setid or selection_chrome_dump or selection_xor_decode
falsepositives:
  - None expected for this specific malware family
level: high

References

• https://www.malware.news/
• https://gbhackers.com/