MacSync Stealer Malware Targets macOS Users

A malicious software named 'MacSync Stealer' (v1.1.2) is currently active and highly destructive, according to BlockBeats. This malware targets macOS users, stealing sensitive data such as cryptocurrency wallets, browser credentials, system keychains, and infrastructure keys like SSH, AWS, and K8s. The malware employs fake AppleScript system dialogs for phishing and displays a false 'unsupported' error message after data is leaked. The indicators of compromise (IOC) have been promptly shared with clients. Users are advised to avoid executing unverified macOS scripts and remain vigilant against unexpected system password prompts. In case of a suspected attack, immediate remediation is necessary: change all infrastructure credentials (SSH, AWS, K8s), invalidate exposed keychains, and swiftly transfer cryptocurrency assets to secure wallets.