MacSync Stealer Targets macOS Users and Trojanizes Hardware Wallet Apps

Jan 21, 2026 · Original article ↗

Summary

Researchers detail a MacSync campaign that uses a ClickFix lure to install a macOS stealer, harvest credentials and wallet data, and trojanize Ledger and Trezor apps to phish PINs and recovery phrases.

Key points

A phishing redirect leads users to a fake macOS installer that persuades them to paste a command into Terminal, bypassing normal app-installation protections.
A daemonized Zsh loader fetches and runs a remote AppleScript payload in memory, then uploads a collected archive to attacker infrastructure.
The stealer repeatedly prompts for the macOS password and targets browser profiles, cryptocurrency wallets, Keychain data, SSH and cloud credentials, Telegram sessions, and selected personal files.
When Ledger Wallet or Trezor Suite is installed, the malware replaces or modifies the app to present a fake recovery wizard that steals device PINs and recovery phrases.
The report describes rotating command-and-control domains and related lure sites, and provides domain indicators, file hashes, YARA rules, and mitigation guidance.
The authors recommend blocking identified jmpbowl domains and caution users against pasting unsolicited commands into Terminal.

Article Details

Attack Vectors: A phishing site impersonating a Microsoft login page redirected users to a macOS installer lure, where they were instructed to paste a command into Terminal.
The command downloaded and piped a Zsh script to the shell. The script daemonized, fetched an AppleScript payload, and executed it with osascript.
The AppleScript repeatedly prompted for the macOS password and checked it locally, then collected browser profiles, wallet data, Keychain files, SSH and cloud configuration, Telegram session data, Notes, and selected user files.
The stager uploaded the collected archive to the campaign infrastructure.
When Ledger Wallet or Trezor Suite was installed, the payload replaced application components or the application bundle with malicious versions that presented a PIN and recovery-phrase phishing wizard.
Defensive Notes: Do not paste untrusted commands into Terminal.
Block the listed jmpbowl domains and monitor for new registrations using the jmpbowl prefix.
Use the provided YARA rules and SHA-256 hashes to detect the AppleScript payload and trojanized Ledger Wallet files.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`crosoftonline[.]com`	Phishing domain impersonating a Microsoft authentication page and used to begin the redirect chain.
DOMAIN	`jmpbowl[.]coupons`	Listed C2 domain used for credential exfiltration and command-and-control.
DOMAIN	`jmpbowl[.]fun`	Listed C2 domain used for credential exfiltration and command-and-control.
DOMAIN	`jmpbowl[.]shop`	Listed C2 domain used for credential exfiltration and command-and-control.
DOMAIN	`jmpbowl[.]space`	Listed C2 domain used for credential exfiltration and command-and-control.
DOMAIN	`jmpbowl[.]today`	Listed C2 domain used for credential exfiltration and command-and-control.
DOMAIN	`jmpbowl[.]top`	Listed C2 domain used for credential exfiltration and command-and-control.
DOMAIN	`jmpbowl[.]world`	Listed C2 domain used for credential exfiltration and command-and-control.
DOMAIN	`jmpbowl[.]xyz`	Listed C2 domain used for credential exfiltration and command-and-control.
DOMAIN	`macclouddrive[.]com`	Listed as the primary ClickFix distribution site.
DOMAIN	`maccloudsafe[.]com`	Listed as a phishing domain associated with the campaign.
DOMAIN	`maccloudvault[.]com`	Listed as a phishing domain associated with the campaign.
DOMAIN	`macfilebackup[.]com`	Listed as a phishing domain associated with the campaign.
DOMAIN	`macfiledrive[.]com`	Listed as a phishing domain associated with the campaign.
DOMAIN	`macfilevault[.]com`	Listed as a phishing domain associated with the campaign.
SHA256	`c99dea85f0ef8d3e2f3771c8ebd02d7dee0d90efc5c8392e5c266a59640a4206`	SHA-256 hash of the malicious Info.plist identified in trojanized Ledger Wallet.app bundles.
SHA256	`ec6bc84be18ce4cb55fb915370c00f2a836ffefc65c6b728efb8d2d28036e376`	SHA-256 hash of the malicious app.asar identified in trojanized Ledger Wallet.app bundles.
URL	`hxxp[:]//jmpbowl[.]xyz/curl/89a229f9a73cffc67089f388c6c12f3f9d80e7ae2c32745cd5212421a89c3e50`	Payload-delivery URL used to retrieve the Zsh stager.
URL	`hxxp[:]//jmpbowl[.]xyz/gate`	C2 upload endpoint used to receive the collected archive.
URL	`hxxps[:]//macclouddrive[.]com/s2/`	ClickFix lure page presented as a macOS cloud storage installer.