MacSync Mac.C notarized Swift dropper for macOS
Malware Activity
Summary
Hide ▲
Show ▼
The MacSync information stealer now arrives on macOS as a code-signed, notarized Swift app, raising the odds of successful delivery and increasing credential-theft risk. The payload is packaged in a disk image and uses a dropper to evade Gatekeeper, while also checking for internet connectivity and wiping execution scripts. The family emerged in April 2025 as Mac.C and can steal iCloud keychain credentials, browser passwords, wallet data, and files.
Related Happenings
CrashStealer meeting-PIN delivery campaign
Campaign
H score35
First: 13.07.2026 22:04
Last: 13.07.2026 22:04
Sources 1
About this happening:
The CrashStealer campaign is delivering a signed, Apple-notarized installer from a fake software site gated by a meeting PIN, narrowing infection opportunities to...
CrashStealer meeting-PIN delivery campaign
CampaignAbout this happening: The CrashStealer campaign is delivering a signed, Apple-notarized installer from a fake software site gated by a meeting PIN, narrowing infection opportunities to...
CrashStealer macOS information stealer activity
Malware Activity
H score10
First: 13.07.2026 20:36
Last: 13.07.2026 20:36
Sources 1
About this happening:
CrashStealer is a macOS information-stealing malware that was tracked in May and seen in attacks in early July. It impersonates Apple's crash-reporting tool by...
CrashStealer macOS information stealer activity
Malware ActivityAbout this happening: CrashStealer is a macOS information-stealing malware that was tracked in May and seen in attacks in early July. It impersonates Apple's crash-reporting tool by...
MacOS XPC cached signature trust privilege escalation privilege-escalation flaw
Vulnerability
H score23
First: 25.06.2026 14:00
Last: 25.06.2026 14:00
Sources 1
About this happening:
macOS XPC trusted software verification lets a non-root user abuse cached signature trust to call privileged helper functions without authentication, opening a route to ...
MacOS XPC cached signature trust privilege escalation privilege-escalation flaw
VulnerabilityAbout this happening: macOS XPC trusted software verification lets a non-root user abuse cached signature trust to call privileged helper functions without authentication, opening a route to ...
MacOS.Gaslight prompt-injection technique aimed at AI-assisted triage
Technical Analysis
H score23
First: 24.06.2026 17:00
Last: 24.06.2026 17:00
Sources 1
About this happening:
macOS.Gaslight is a Rust-based macOS implant and information stealer assessed with high confidence as the work of North Korea-aligned threat actors. The sample uses ...
MacOS.Gaslight prompt-injection technique aimed at AI-assisted triage
Technical AnalysisAbout this happening: macOS.Gaslight is a Rust-based macOS implant and information stealer assessed with high confidence as the work of North Korea-aligned threat actors. The sample uses ...
SHub Reaper macOS infostealer variant
Malware Activity
H score23
First: 19.05.2026 00:42
Last: 19.05.2026 00:42
Sources 1
About this happening:
The SHub Reaper macOS infostealer now uses AppleScript and a fake Apple security update lure to infect Macs, raising the risk of credential theft and remote access. It...
SHub Reaper macOS infostealer variant
Malware ActivityAbout this happening: The SHub Reaper macOS infostealer now uses AppleScript and a fake Apple security update lure to infect Macs, raising the risk of credential theft and remote access. It...
Timeline
-
22.12.2025 22:43 2 articles · 6mo ago
MacSync Mac.C notarized Swift dropper for macOS
Initial DisclosureThe initial phase centered on a signed DMG dropper delivered from `https://zkcall.net/download`, packaged to avoid direct Terminal use. The decoded payload then exposed the usual MacSync Stealer behavior after basic environment checks.
Show sources
- New MacSync malware dropper evades macOS Gatekeeper checks — www.bleepingcomputer.com — 22.12.2025 22:43
- Reworked MacSync Stealer Adopts Quieter Installation Process — www.infosecurity-magazine.com — 23.12.2025 18:45