MacSync under the microscope: new delivery methods and a new payload

MacSync is a macOS infostealer and backdoor malware family distributed as malware-as-a-service, which has evolved to use binary droppers and new delivery techniques. The latest variant uses a multi-stage infection chain starting with malicious DMG images, leveraging iCloud calendar links for payload delivery and employing XOR-encrypted URLs and AES-encrypted payloads. The malware collects browser data, crypto wallets, Telegram data, keychains, and system information, and establishes persistence via LaunchAgents, shell configuration files, and Git hooks. A new cryptographic key exchange mechanism using Curve25519 and custom 'pkgunpack' utility enhances stealth and complicates analysis.

AI-extracted · verify before operational use