MacSync Stealer Hides Behind 30+ Domains While Stealing Passwords and Sensitive Mac Data

MacSync Stealer is expanding the risk facing Mac users by turning everyday web browsing and Terminal activity into a route for password theft.

The macOS-focused malware uses short-lived online infrastructure, making simple blocklists less effective and leaving victims exposed to account theft, financial loss, and disclosure of private files.

The campaign begins with ClickFix social engineering. A victim is persuaded to paste a command into Terminal, often after encountering a fake verification, download, or support prompt.

That command retrieves the attacker payload, a pattern also seen in a recent macOS ClickFix attack targeting users through bogus CAPTCHA checks.

Microsoft said in a report shared with Cyber Security News (CSN) that it tracked the activity from command-and-control contact through data collection, temporary storage, and theft.