MacSync Stealer Uses SEO Poisoning and ClickFix to Target macOS Users
Summary
Researchers detail a macOS malware chain that uses poisoned search results and fake verification prompts to trick users into running a Terminal command, steal sensitive data, and tamper with Ledger Live.
Key points
- Malicious search results for book PDFs redirect users to a fake verification page that prompts them to run a Terminal command.
- The command downloads and executes staged scripts, which retrieve further instructions and an AppleScript payload from attacker-controlled infrastructure.
- MacSync Stealer targets browser credentials and cookies, cryptocurrency wallet data, keychains, SSH keys, cloud configuration files, and selected user documents.
- The malware compresses collected data and uploads it to its command-and-control server in chunks, then deletes the local archive.
- It checks for Ledger Live and attempts to replace application components, a behavior researchers say could support transaction manipulation and financial persistence.
- The article identifies associated domains, an API-key header, and temporary file paths as indicators of compromise.
Article Details
- Attack Vectors
- SEO-poisoned search results targeting users looking for PDF versions of popular books lead to a fake verification page.
- The fake verification flow uses ClickFix-style social engineering to persuade victims to run a command in Terminal.
- The command retrieves and executes staged scripts from attacker infrastructure; the loader fetches further AppleScript instructions and uploads collected data.
- The AppleScript stealer collects browser credentials and cookies, cryptocurrency wallet data, keychains, SSH keys, cloud configuration files, messaging data, and selected user documents.
- The malware attempts to download files that replace Ledger Live application components and re-sign the modified application.
- Defensive Notes
- Do not run Terminal commands supplied by web pages posing as download or human-verification steps.
- Monitor for suspicious curl-to-shell execution, Base64 decoding and gzip decompression followed by eval, and AppleScript launched with remotely retrieved content.
- Monitor for unexpected access to browser credential stores, wallet extension data, keychains, SSH and cloud configuration files, and sensitive files in Desktop, Documents, and Downloads.
- Investigate unexpected chunked HTTP PUT uploads and creation or deletion of /tmp/osalogging.zip and /tmp/sync*.
- Inspect Ledger Live for unexpected changes to app.asar or Info.plist and unexpected re-signing.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | allfile[.]me | Domain serving the redirect to the fake verification page in the reported malicious delivery chain. |
| DOMAIN | b[.]mou[.]ir | Domain in the reported SEO-poisoned result that redirected users into the malicious delivery chain. |
| DOMAIN | bracesarlington[.]com | Attacker-controlled domain used to deliver scripts and AppleScript instructions, receive uploaded data, and serve files for Ledger Live tampering. |
| DOMAIN | datacloudhost4[.]baby | Host of the malicious instruction page that presented the command for victims to execute. |
| URL | hxxp[:]//bracesarlington[.]com/curl/0dbe695426c12ddd6fb1085e738869149061e28daad1b75eb40dea13ef73b5de | Attacker-hosted second-stage script retrieved and piped to zsh. |
| URL | hxxp[:]//bracesarlington[.]com/dynamic?txd=0dbe695426c12ddd6fb1085e738869149061e28daad1b75eb40dea13ef73b5de | Attacker-controlled endpoint used by the loader to retrieve further instructions. |
| URL | hxxp[:]//bracesarlington[.]com/dynamic?txd=0dbe695426c12ddd6fb1085e738869149061e28daad1b75eb40dea13ef73b5de&pwd=PASSWORD | Attacker-controlled instruction-retrieval URL shown with a password parameter. |
| URL | hxxp[:]//bracesarlington[.]com/gate?buildtxd=0dbe695426c12ddd6fb1085e738869149061e28daad1b75eb40dea13ef73b5de&upload_id=$upload_id&chunk_index=$i&total_chunks=$total_chunks | Attacker-controlled endpoint used to receive chunks of the stolen archive. |
| URL | hxxps[:]//allfile[.]me/loading/?t=Inspired%20%20How%20To%20Create%20%20Products%20Customers%20Love%20%20English%20Edition&s=Yi5tb3UuaXI | Redirect URL serving the fake verification page in the reported malicious delivery chain. |
| URL | hxxps[:]//b[.]mou[.]ir/renhancef/84974J166D/vallocated/88983JD/inspired__how_to_create__products_customers-love__english-edition[.]pdf | Specific SEO-poisoned link reported to redirect users into the malicious delivery chain. |
| URL | hxxps[:]//datacloudhost4[.]baby/?c=ADtxlGmPdgUAd4oCAElOOQASAAAAAADt | Malicious instruction-page URL that directed victims to execute the initial command. |
MITRE ATT&CK
T1005 · Data from Local SystemThe stealer collects local wallet data, keychains, browser data, messaging data, and selected user documents.T1027 · Obfuscated Files or InformationThe loader hides script content using Base64 encoding and gzip compression.T1041 · Exfiltration Over C2 ChannelThe archive is uploaded to the command-and-control server using chunked HTTP PUT requests.T1059.002 · AppleScriptThe retrieved AppleScript payload is executed using osascript.T1059.004 · Unix ShellThe initial command and retrieved scripts execute through zsh.T1105 · Ingress Tool TransferThe malware retrieves staged scripts and further payload instructions from attacker infrastructure.T1140 · Deobfuscate/Decode Files or InformationThe loader decodes the Base64 payload and decompresses it with gzip before execution.T1204.004 · Malicious Copy and PasteVictims are persuaded by the fake verification flow to copy and execute a malicious Terminal command.T1539 · Steal Web Session CookieThe malware collects browser session cookies, including Chromium and Firefox cookie stores.T1552.001 · Credentials In FilesThe malware copies SSH keys and AWS and Kubernetes configuration files from the user's home directory.T1555.003 · Credentials from Web BrowsersThe malware collects saved credentials from Chromium-based browser and Firefox profile files.T1560.001 · Archive via UtilityCollected files are compressed into /tmp/osalogging.zip before exfiltration.
Malware
Products
Ledger LiveThe campaign further escalates by targeting Ledger Live installations, modifying application components to potentially enable transaction manipulation and long-term financial persistence.macOSCloudSEK researchers identified a multi-stage macOS malware delivery chain leveraging SEO poisoning and ClickFix-style social engineering to distribute an information-stealing malware dubbed MacSync Stealer.