Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

MacSync Stealer signed Swift dropper and in-memory payload analysis

Technical Analysis
First reported
Last updated
Happening score
H score 22
2 unique sources, 2 articles

Summary

Hide ▲

Jamf Threat Labs identified a reworked MacSync Stealer sample on macOS that uses a code-signed, notarized Swift application disguised as a messaging app installer to reduce user friction and help it slip past Gatekeeper checks. The dropper is distributed in zk-call-messenger-installer-3.9.2-lts.dmg from zkcall[.]net/download, then performs checks before downloading and executing an encoded script through a helper component. The campaign also uses curl flag changes, dynamic variables, and an unusually large 25.5 MB DMG to improve reliability and evade detection, and Apple revoked the code signing certificate after discovery.

Related Happenings

CrashStealer meeting-PIN delivery campaign

Campaign
H score35 First: 13.07.2026 22:04 Last: 13.07.2026 22:04 Sources 1

About this happening: The CrashStealer campaign is delivering a signed, Apple-notarized installer from a fake software site gated by a meeting PIN, narrowing infection opportunities to...

Open Happening

CrashStealer macOS information stealer activity

Malware Activity
H score10 First: 13.07.2026 20:36 Last: 13.07.2026 20:36 Sources 1

About this happening: CrashStealer is a macOS information-stealing malware that was tracked in May and seen in attacks in early July. It impersonates Apple's crash-reporting tool by...

Open Happening

MacOS XPC cached signature trust privilege escalation privilege-escalation flaw

Vulnerability
H score23 First: 25.06.2026 14:00 Last: 25.06.2026 14:00 Sources 1

About this happening: macOS XPC trusted software verification lets a non-root user abuse cached signature trust to call privileged helper functions without authentication, opening a route to ...

Open Happening

MacOS.Gaslight prompt-injection technique aimed at AI-assisted triage

Technical Analysis
H score23 First: 24.06.2026 17:00 Last: 24.06.2026 17:00 Sources 1

About this happening: macOS.Gaslight is a Rust-based macOS implant and information stealer assessed with high confidence as the work of North Korea-aligned threat actors. The sample uses ...

Open Happening

SHub Reaper macOS infostealer variant

Malware Activity
H score23 First: 19.05.2026 00:42 Last: 19.05.2026 00:42 Sources 1

About this happening: The SHub Reaper macOS infostealer now uses AppleScript and a fake Apple security update lure to infect Macs, raising the risk of credential theft and remote access. It...

Open Happening

Timeline

  1. 23.12.2025 18:45 3 articles · 6mo ago

    Jamf uncovers signed MacSync Stealer Swift dropper

    Initial Disclosure

    Jamf Threat Labs uncovered a reworked MacSync Stealer macOS malware sample during routine threat monitoring while reviewing alerts triggered by internal YARA rules. The sample is a code-signed and notarized Swift application packaged inside a disk image posing as a messaging app installer, and it silently retrieves an encoded script from a remote server through a helper component before execution. Jamf later reported the associated developer certificate to Apple, and Apple revoked it.

    Show sources
    Open in new tab