Reported by 4 outlets

Timeline

1. original reporting

   MacSync: The Evasive macOS Stealer Exploiting ClickFix Lures

   malware.news · 35d ago · September 8th, 2026

   Executive Summary MacSync Stealer is a family of macOS information stealers and remote-access stagers designed to evade detection and sold commercially under a malware-as-a-service (MaaS) model. In the attack chain, MacSync binaries are native stagers and multi-part exfiltration engines. Rather than standalone harvesters, the payloads are lightweight 64-bit Mach-O executables that detach silently from terminal sessions, load credential-dumping modules directly into memory, and reliably exfiltrate stolen credentials back to campaign infrastructure. MacSync is delivered primarily through ClickFix social engineering and search engine malvertising. It uses a modular, multi-tier execution strategy to bypass Apple Gatekeeper, XProtect, and endpoint detection and response (EDR) tools while keeping a minimal footprint on disk. Stealth Session Daemonization: On execution, MacSync detaches from the controlling terminal session using POSIX fork() and setsid() system calls. It reparents to PID 1 (launchd) and redirects stdin, stdout, and stderr to /dev/null so error messages and process output do not appear in the console. Template-Based Single-Byte XOR Obfuscation : To evade static signatures and automated string

2. update from gbhackers.com

   Hackers Use ClickFix Lures to Deploy MacSync Stealer and Bypass macOS Security.

   gbhackers.com · 33d ago · September 10th, 2026

   The campaigns do not require a macOS vulnerability; instead, they abuse user trust by persuading victims to paste attacker-controlled commands into Terminal, sidestepping traditional file-centric protections. However, […] The post Hackers Use ClickFix Lures to Deploy MacSync Stealer and Bypass macOS Security. appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

3. update from cyberpress.org

   MacSync macOS Stealer Exploits ClickFix Lures to Steal Credentials and Cryptocurrency Wallets

   cyberpress.org · 33d ago · September 10th, 2026

   The malware relies on social engineering instead of exploiting a software vulnerability. Victims are directed to fraudulent pages impersonating popular brands, including Google Meet, Zoom, Claude AI , ChatGPT, Cloudflare, Docker, Notion, Cursor, TradingView, and cryptocurrency applications. The pages display fake errors, CAPTCHA checks, or installation prompts that instruct users to copy and run a command in macOS Terminal. Once executed, the command launches a lightweight native Mach-O stager. The malicious binary silently detaches from the Terminal session using the fork() and setsid() functions, then redirects standard input, output, and error streams to /dev/null . This prevents visible error messages and helps the malware operate in the background without alerting the victim. MacSync samples also use single-byte XOR obfuscation with the 0xAA key to hide command strings, temporary paths, API headers, and command-and-control (C2) addresses from static security scans. The sample analyzed was an ad-hoc signed 64-bit x86_64 Mach-O executable using the signing identifier com.utils.Launcher . MacSync ClickFix Wallet Heist The stager contacts its C2 infrastructure over HTTPS and downloads a dynamic AppleScript payload . Rather than saving the script to

4. update from securityonline.info

   The MacSync macOS stealer targets Apple users worldwide. See how MacSync macOS stealer ClickFix lures evade Gatekeeper to steal sensitive cr

   securityonline.info · 32d ago · September 11th, 2026

   See how MacSync macOS stealer ClickFix lures evade Gatekeeper to steal sensitive cr

   via Mastodon https://securityonline.info/macsync-macos-stealer-clickfix/?utm_source=mastodon&utm_medium=jetpack_social