🕵️ MacSync

The items that name it 9

• Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware
  writeupas classification.key entities2026-10-21
• Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
  writeupas classification.key entities2026-09-28
• DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer
  writeupas classification.key entities2026-09-22
• Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware
  writeupas classification.key entities2026-09-15
• The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms
  writeupas classification.key entities2026-08-27
• MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer
  writeupas classification.key entities2026-08-17
• Reverse Engineering the Six Stages of MacSync Stealer and RAT
  writeupas classification.key entities2026-07-29
• Deceptive Installers: How Fake Apps Target macOS
  writeupas threat actors2026-06-10

  macOS infostealer malware family; uses background-image Gatekeeper bypass instructions in deceptive DMG installers

• Something Phishy in the /tmp Folder
  writeupas threat actors2026-03-18

  macOS infostealer that used a fake 'macOS Protection Service' password prompt to gain access, then scraped Chrome cookies, Safari data, Apple Keychain credentials, and 200+ crypto wallets, staging stolen data in /tmp/salmonela/ before zipping it and exfiltrating via curl POST to a C2 server, then de