MacSync Stealer Uses ClickFix to Target U.S. SLTT macOS Users
Summary
CIS details a MacSync Stealer campaign targeting U.S. SLTT macOS users through SEO-poisoned fake CAPTCHAs. The malware can steal credentials, system data and crypto assets, and trojanize Ledger apps to capture seed phrases.
Key points
- SEO-poisoned search results lead victims to fake CAPTCHA pages that trick them into pasting a malicious command into Terminal.
- A Zsh loader retrieves an AppleScript payload from C2 and runs it in memory; the campaign uses API-key-gated infrastructure and rotates C2 domains.
- The malware prompts for the macOS account password and collects browser credentials, Keychain data, SSH keys, cloud credentials, files, and messaging-app data.
- It targets more than 80 browser wallet extensions and over 20 desktop wallet applications.
- The malware can replace Ledger application files with backdoored versions that capture and exfiltrate seed phrases, potentially persisting after the stealer is removed.
- CIS recommends SLTT organizations use shared threat intelligence and malicious-domain blocking; MS-ISAC distributed more than 1,000 IOCs.
Article Details
- Attack Vectors
- SEO poisoning directs macOS users searching for free e-book downloads to a fake CAPTCHA page that delivers a ClickFix lure.
- The lure instructs victims to paste a Base64-encoded command into Terminal, which downloads and executes a Zsh script.
- The Zsh script authenticates to C2 and retrieves an AppleScript payload, which runs in memory through osascript.
- The payload uses a deceptive password prompt to obtain the macOS account password and collects browser credentials, Keychain data, SSH keys, cloud credentials, files, and cryptocurrency-wallet data.
- The malware exfiltrates collected data in 10 MB segments using HTTP PUT requests; a modified Ledger application separately captures and exfiltrates wallet seed phrases.
- Defensive Notes
- Treat the macOS account password and associated protected data as compromised if the deceptive authentication prompt was entered.
- If a Ledger application may have been opened after the infection window, treat seed phrases for wallets accessed through it as compromised; removing MacSync Stealer may not remove the backdoor in the modified application.
- CIS CTI recommends U.S. SLTT organizations join the MS-ISAC and use its Malicious Domain Blocking and Reporting service.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | houstongaragedoorinstallers[.]com | Different C2 domain identified in another MacSync Stealer sample from the same campaign period. |
| DOMAIN | mansfieldpediatrics[.]com | C2 domain serving the Zsh bootstrap script; described as impersonating a pediatric medical practice. |
| URL | hxxp[:]//filegrowthlabs[.]com/s3/?c=AA-0uWlVgQUAHYwCAFVTOQASAAAAAACP | Fake CAPTCHA landing-page URL used to deliver the ClickFix lure. |
MITRE ATT&CK
T1005 · Data from Local SystemThe payload collects local files and system data, including browser data, notes, shell history, and cloud configuration material.T1041 · Exfiltration Over C2 ChannelThe script exfiltrates the collected archive to C2 through HTTP PUT requests in 10 MB segments.T1056.002 · GUI Input CaptureA deceptive authentication dialog prompts victims to enter their macOS account password.T1059.002 · AppleScriptThe AppleScript payload is executed through macOS osascript.T1059.004 · Unix ShellThe downloaded Zsh shell script executes commands, including retrieving and running the next-stage payload.T1105 · Ingress Tool TransferThe shell script retrieves the remote Zsh script and later the Stage 2 AppleScript payload from C2.T1204.004 · Malicious Copy and PasteVictims are instructed to paste a malicious command into Terminal as part of the ClickFix lure.T1552.004 · Private KeysThe payload collects SSH private keys from the victim’s profile.T1555.001 · KeychainThe payload harvests the macOS Keychain database.T1555.003 · Credentials from Web BrowsersThe payload copies browser profile data including Cookies and Login Data.