MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer

What it is

Detection and artifact detail for MacSync Stealer, the macOS infostealer/RAT the summary describes. This adds the concrete indicators and detection guidance the Huntress SOC analysts (Ryan Dowd, Josh Kiriakoff) surfaced in their Tradecraft Tuesday walkthrough — the parts an engineer needs to actually hunt for it.

How it works

The curl one-liner returns a 1,442-byte zsh loader: a three-line wrapper around a gzip-compressed, Base64-encoded payload delivered as a heredoc. The Base64 line's first four "magic bytes" identify it as gzip. The wrapper is polymorphic — each build changes based on the victim token, so the loader hash is worthless for detection.

Stage 2 (daemon_function) runs in the background, fetches and executes the stage-3 AppleScript in memory, uploads the stolen archive at /tmp/osalogging.zip, then deletes the staging file. Nothing of this is visible in Terminal.

Stage 3 is server-generated AppleScript run via osascript, never written to disk — so the operator can change stealer behavior per-victim at will without touching the loader. In this sample it first requests Full Disk Access via a TCC prompt (distinct from the Screen Recording abuse in the later signed helper).

What to do

Detect on behavior, not hashes. The analysts' stated approach:

• Build detection logic around curl triggers with Base64 content in shell.
• Hunt for the exfil artifact /tmp/osalogging.zip.
• The loader request can be replayed with a spoofed macOS User-Agent and the static api-key — useful for pulling live samples, but also a detection pivot on outbound requests.

flowchart TD
    A[curl one-liner in Terminal] --> B[1442-byte polymorphic zsh loader<br/>hash-based detection fails]
    B --> C[daemon_function in background]
    C --> D[Fetch server-gen AppleScript<br/>runs in memory, not on disk]
    C --> E[Upload /tmp/osalogging.zip]
    D --> F[TCC prompt: Full Disk Access]
    F -->|user clicks Allow<br/>prompt fatigue| G[stealing begins]
    F -->|user denies| H[chain cut]

Caveats

• The AppleScript "brain" is generated server-side on the fly, so what stage 3 does varies per victim — the behavior described is one observed sample, not a fixed payload.
• The Full Disk Access prompt is indistinguishable to users from legitimate permission requests (one attendee noted their own management tooling issues the same request), so relying on user rejection is weak.
• Sample was pulled from attacker infrastructure after the victim powered off; artifacts reflect that recovered sample, not necessarily every campaign build.