MacSync malware upgrades, targeting macOS users of cryptocurrency and development tools

A fresh variant of the MacSync information stealer has been spotted, altering its approach by employing a more complex infection chain aimed at macOS users who work with cryptocurrency and development utilities.

Previous versions of MacSync mainly depended on a single line of code entered into the Terminal, a technique that often surprised users while leaving a relatively straightforward forensic footprint. The newest campaigns, in contrast, start with seemingly harmless disk‑image (DMG) files that, once opened, quietly install extra payloads before displaying an application that appears legitimate.

According to security researchers, the revamped delivery method is crafted to blend into the daily routines of developers and crypto enthusiasts. These malicious DMG files are frequently masqueraded as well‑known tools—such as blockchain wallets, code editors, or package managers—exploiting the trust users have in them. When the image is mounted, a concealed installer drops a secondary component that alters existing apps, turning them into channels for credential theft and cryptocurrency mining.

Technical analysis shows that the new MacSync strain uses a multi‑stage loader written in Swift, which dynamically pulls encrypted modules from command‑and‑control servers. The fetched modules comprise keyloggers, clipboard monitors, and code that injects malicious scripts into development environments, enabling attackers to seize API keys, private keys, and other sensitive information. Additionally, the malware can covertly mine cryptocurrencies, leveraging the victim’s hardware without noticeable performance loss.

This move toward a more sophisticated delivery chain mirrors a wider trend in macOS‑focused threats. Although macOS has traditionally been viewed as a lower‑risk platform compared to Windows, its growing adoption among developers and the rising value of digital assets have made it a more enticing target for financially driven cybercrime.

Experts recommend that users verify the provenance of any DMG file before opening it, especially when it purports to be a crypto wallet or a development tool. Activating stricter Gatekeeper settings, keeping the operating system and all applications current, and using reputable endpoint protection can lower infection risk. For enterprises, deploying application whitelisting and monitoring for anomalous process activity can help spot the stealthy behaviors linked to MacSync.

Researchers continue to track the malware’s evolution, noting that its modular architecture permits rapid updates to evade new defenses. As the line between legitimate developer utilities and malicious code becomes increasingly blurred, vigilance remains the most effective safeguard against this emerging macOS threat.