🕵️ MacSync Stealer

The items that name it 6

• Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware
  writeup2026-10-21It is written here as MacSync Stealer: mentioned from an August Huntress analysis of an incident that began with a sponsored Google result for installing Claude on a Mac.
• Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
  writeup2026-09-28

  Prior campaign: a sponsored Google result led Mac users to a shared Claude conversation instructing a malicious Terminal command that deployed MacSync stealer.

• DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer
  writeup2026-09-22

  Multi-stage stealer-RAT previously reverse-engineered by Huntress, described as the macOS cousin pattern to this Windows VB6 DarkMe variant

• Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware
  writeup2026-09-15

  Six-stage macOS stealer kill chain covered in a previous Tradecraft Tuesday episode, noted for similarities to the AMOS variant in this campaign

• The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms
  writeup2026-08-27

  Stealer malware delivered via a fake claude.ai/share Apple Support install guide, launched via a six-stage kill chain resulting in theft of cookies, credentials, keychain secrets, Telegram sessions, SSH and cloud keys

• MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer
  writeup2026-08-17

  macOS infostealer and RAT delivered via a fake Claude install guide; six-stage kill chain collecting browser cookies/logins, keychain secrets, account passwords, Telegram sessions, SSH and cloud keys, and targeting cryptocurrency wallets via trojanized apps.