Security researchers from Huntress have made significant strides in understanding a new macOS malware family known as MacSync. This comes after their comprehensive analysis traced the genesis of the malware back to a misleading advertisement designed to appear as installation instructions for Anthropic’s Claude AI assistant.
The malware infection reportedly began when an unsuspecting victim conducted a Google search for guidance on how to install Claude on a Mac. The individual clicked on a sponsored ad that appeared above Anthropic’s official listing, which ultimately led them to a webpage hosted on the legitimate claude.ai domain. This page presented a seemingly innocuous shared conversation about Claude, styled to resemble an official Apple Support guide. It lured users into executing a single curl command within their Terminal, thus initiating the malware attack.
Huntress highlighted the deceptive nature of this lure. Since it was hosted on Anthropic’s own infrastructure and was served with a valid SSL certificate, the usual warning signs associated with phishing attempts—such as suspicious domain names or certificate alerts—were absent. This lack of immediate red flags rendered it easier for potential victims to fall prey to the attack.
### A Complex Intrusion Chain
The command executed by the victim prompted a lightweight zsh loader, which unpacked and executed another script in memory. This second-stage script fetched a small AppleScript payload, approximately 46KB, from the attacker’s server. Importantly, keeping this stage server-side and protected by a static API key allowed for flexibility in modifying the malware’s operations without leaving any physical traces on the victim’s device.
Once activated, the AppleScript component ingeniously manipulated the victim into granting Full Disk Access—a broad permission on macOS—through a spoofed system dialogue. Additionally, it created a persistence entry in the user’s shell profile to ensure its survival through subsequent Terminal sessions. The malware then employed a fake System Preferences prompt to phish for the victim’s account password, validating each attempt in real time against macOS’s Open Directory service.
Armed with Full Disk Access and a valid password, the malware harvested Safe Storage encryption keys from the login keychain, allowing it to access saved browser credentials, cookies across multiple Chromium-based browsers, SSH and cloud credentials, Telegram session data, and information from approximately 21 desktop cryptocurrency wallet applications.
The malware subsequently deployed a Mach-O remote access trojan (RAT) written in C++, which was set as a persistent LaunchAgent. This allowed the operator to maintain an interactive shell and file transfer capabilities via a hardcoded, TLS-wrapped command-and-control channel linked to a bare IP address. Compounding the threat, a separately signed helper binary, masked as “Screen Recording,” was specifically used to gain screen-recording permissions from macOS, thereby enabling the RAT to capture the victim’s display.
### Targeting Cryptocurrency Wallets
Among its various capabilities, the malware’s most alarming function targets software associated with hardware wallets. When applications like Ledger Live or Trezor Suite are detected, MacSync can download modified versions of these applications, replacing the legitimate files to mask its presence. The app is subsequently re-signed with an ad-hoc signature, allowing it to launch without raising any alarms. The next time the victim interacts with what they think is their trusted wallet manager, a fake recovery phrase entry screen appears, exfiltrating any entered seed phrases to the attackers’ servers.
Analysis of these manipulated Ledger payloads revealed that 26 of 30 unpacked files were byte-identical across applications designed for different Ledger products. This suggests that the same modified payload was utilized across various targets rather than being custom-built for each application.
### Ties to Known Malware Families
Huntress noted that the credential-theft tactics employed mirrored those of the well-documented AMOS (Atomic Stealer) malware family. The use of AppleScript, a password validation loop based on dscl, and a shared targeting list for browsers and wallets all echoed techniques commonly associated with AMOS. Despite these similarities, Huntress refrained from attributing the attack to a specific actor, labeling the resemblance as a familial relationship rather than a direct connection.
Huntress was able to reconstruct the full attack chain, including elements that never touched the victim’s disk, by analyzing the loader’s network requests and pulling each stage from the attacker’s delivery servers after the initial victim’s host had been rendered offline.
### Recommendations for Detection
Huntress cautioned that detection based solely on file hashes or build identifiers would be ineffective, as these change with every deployment. Instead, they recommended that defenders look for behavioral indicators. This includes monitoring for curl commands that pipe base64-decoded content into zsh or osascript, identifying LaunchAgent plist files that point to unsigned binaries disguising themselves as software update processes, and flagging screen capture requests stemming from non-Apple parent processes. Attention should also be given to ad-hoc code signatures marking applications that should bear vendor signatures, especially cryptocurrency wallet software.
This incident marks the third documented case by Huntress this year of malware proliferated through compromised search results that point to AI-hosted installation guides. Previous campaigns included those leveraging both shared ChatGPT conversations and a fraudulent Claude desktop malvertising scheme that delivered the SectopRAT trojan.
For additional insights, readers can refer to Huntress’s detailed report on the attack.