Hackers Use ClickFix Lures to Deploy MacSync Stealer and Bypass macOS Security.

Threat actors are increasingly using ClickFix social-engineering lures and search-engine malvertising to deploy MacSync Stealer, a macOS-focused information stealer and remote-access staging framework sold through a malware-as-a-service model.

The campaigns do not require a macOS vulnerability; instead, they abuse user trust by persuading victims to paste attacker-controlled commands into Terminal, sidestepping traditional file-centric protections.

However, Russian-language artifacts observed in some samples do not establish attribution to a particular actor or criminal group.

The operation appears structured as a MaaS ecosystem, with malware developers supplying payloads and infrastructure capabilities to affiliates that operate their own lures, domains, traffic-distribution systems, and victim-selection logic.

The attack begins when a victim lands on a fraudulent page through SEO poisoning, compromised sites, malicious ads, or impersonated software-download portals.

Common lures imitate Claude AI, ChatGPT, Google Meet, Zoom, Cloudflare Turnstile, Docker, Cursor, Notion, TradingView, and cryptocurrency applications.

The page claims that a CAPTCHA, download, audio driver, WebSockets connection, or installer error must be fixed.

It then instructs the user to open Terminal and execute a command, commonly a disguised curl pipeline passed to zsh.

Because the command is manually executed by the user rather than delivered as a conventional application package, Gatekeeper and notarization checks may not inspect the real malicious stage in the same way they would a downloaded installer.

Traffic-distribution systems used by affiliates can inspect browser User-Agent data and redirect macOS visitors into a MacSync-specific ClickFix path, while Windows users may be sent to campaigns distributing other stealers.

Microsoft has also documented broader macOS ClickFix infrastructure using look-alike domains and server-side gating to hide malicious content from crawlers and automated analysis.

MacSync’s native stager is a lightweight 64-bit Mach-O executable, not a standalone credential harvester.

Its role is to silently establish execution, retrieve modular payloads, coordinate collection, and exfiltrate stolen data with minimal filesystem exposure.

ClickFix Lures Target macOS

On launch, the binary can daemonize through POSIX fork() and setsid() calls. The parent exits, while the child detaches from the terminal, becomes reparented to launchd, and redirects standard input, output, and error streams to /dev/null.

This suppresses visible command output and reduces the chance that a victim notices execution errors or background activity.

Seqrite Researchers said that, MacSync, which emerged publicly as Mac.c Stealer in April 2025 and was later rebranded, is associated in public research with the developer identity “Mentalpositive.”

Static detection is further hindered by template-based single-byte XOR string obfuscation.

Functional strings including C2 paths, API headers, command templates, temporary-file paths, and network fragments are decrypted only at runtime into stack buffers.

This limits useful indicators in basic strings output and weakens static signature coverage.

A key MacSync capability is its dynamic AppleScript pipeline.

The stager polls command-and-control infrastructure with custom HTTP headers, including an api-key value and campaign token, and then streams the server response directly into /usr/bin/osascript through standard input.

That approach avoids dropping the AppleScript stealer as a persistent file. It also gives operators the ability to alter collection logic server-side without recompiling or redistributing the Mach-O loader.

Public reporting has linked MacSync activity to the theft of browser credentials, macOS Keychain data, SSH keys, cloud credentials, session tokens, cryptocurrency-wallet data, and files stored on compromised devices.

The payload may also request a user’s macOS password through deceptive dialogs and establish persistence through LaunchAgents masquerading as legitimate-looking entries, such as Google or Apple-related service names.

MacSync stages collected data into an archive, often referenced as /tmp/osalogging.zip, then divides it into 10 MB chunks using the native dd utility.

Each segment is transmitted through HTTP PUT requests, with retry delays designed to tolerate intermittent network failures.

Following a successful HTTP 200 response, the malware deletes both the staged archive and its status file, /tmp/ httpcode, reducing forensic residue.

Microsoft identified more than 30 related MacSync domains by pivoting on persistent behavioral traits instead of rapidly rotating hostnames.

Useful hunting indicators include requests to paths resembling /dynamic?txd=<token> and /gate?buildtxd=<token>, custom API-key headers, osascript execution fed by curl, archive creation in /tmp, and chunked PUT uploads.

Organizations should treat unsolicited Terminal instructions as a high-risk execution vector, especially for developers, cryptocurrency users, and remote workers.

Security teams should monitor for suspicious curl | osascript chains, enforce managed software-distribution channels, restrict unnecessary Terminal access for standard users, and use MDM and EDR controls to reduce unauthorized access to sensitive macOS data stores.

IOCs

Indicator Type	Value	Description
SHA-256 Hash	9ff32f7c0108e9d27a3b491edf04827b6ca025f44db68aeadc44eeb97c9aab11	Native Mach-O Stager Binary
MD5 Hash	9678f71ea4cccbc3d511dc8d7f24b113	Native Mach-O Stager Binary
SHA-1 Hash	59508d071661ea70fa5fcbe6f9e2fb72506e57df	Native Mach-O Stager Binary
Code Signing ID	com.utils.Launcher	Ad-hoc signature bundle identifier
CDHash	d182eb7cba0ffa42d770d7b0d3499e49f24163a2	Code Directory Hash

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.