A substantially reworked version of MacSync, a fast-evolving macOS infostealer first advertised on the dark web as Mac.c in 2025, is distributed under a malware-as-a-service (MaaS) model. The latest variant appeared in the wild in September 2026 with a more complex, binary-driven infection chain, Kaspersky's Securelist team reports.

The campaign starts with malicious DMG images carrying an .APP loader that strips the com.apple.quarantine attribute and decrypts a staged URL, the analysis said. 

In at least one sample, that link pointed to a public iCloud CalDAV calendar, whose event description hid shell commands piped into zsh -s. 

A chain of binary droppers, complete with anti-debugging checks, pulls encrypted infostealer and backdoor modules.

The Swift infostealer harvests browser data, cryptocurrency wallet files, Telegram data, the Keychain, and SSH, AWS, and Kubernetes configs. 

It verifies the admin password through the PAM API, a technique first observed in the Pam Stealer family in July 2026, rather than the usual dscl. 

The Objective-C backdoor disguises itself as Finder, persists via a LaunchAgent named com.apple.finder.agent, and supports deploy_ext, deploy_ledger, regrab, and live_browser commands, the last hinting at browser MitM capability.

The data suggests developers, crypto enthusiasts, and other users connected in some way to IT and the crypto space are the main targets, with lures including a fake Toria wallet app promoted on X and Telegram. 

Compromised developer machines expand attacker reach into corporate systems, raising the stakes for defenders tracking this threat.

In other news, reports last week indicated that fake Bitrefill checkouts spread through search results. An August Huntress report said a MacOS ClickFix scam steals crypto gradually.