Security researchers at Huntress have reverse-engineered a previously undocumented macOS malware family, dubbed MacSync, after tracing an intrusion back to a malicious advertisement masquerading as installation instructions for Anthropic’s Claude AI assistant.
According to Huntress, the infection began when a victim searched Google for guidance on installing Claude on a Mac and clicked a sponsored result placed above Anthropic’s own organic listing. The ad led to a page hosted on the legitimate claude.ai domain: a publicly shared Claude conversation, styled to look like an Apple Support guide, instructing the user to paste a single curl command into Terminal.
Because the lure sat on Anthropic’s own infrastructure and was served over a valid certificate, it presented none of the usual red flags associated with phishing pages, such as a lookalike domain or certificate warning, Huntress said.
A six-stage chain built for persistence and profit
Huntress said the pasted command triggered a deliberately lightweight zsh loader that unpacked and executed a second-stage script in memory, which in turn fetched a roughly 46KB AppleScript payload from the attacker’s server on demand. Keeping this stage server-side, gated behind a static API key, allowed the operator to alter the stealer’s behaviour at will without leaving a payload on disk for defenders to recover, researchers noted.
That AppleScript component first manipulates the victim into granting Full Disk Access, a broad macOS permission, using a spoofed system dialogue and a temporary persistence entry written into the user’s shell profile to survive a Terminal restart. It then phishes the account password via a fake System Preferences prompt, validating each guess in real time against macOS’s Open Directory service until a correct one is entered.
With Full Disk Access and a validated password in hand, the malware harvests Safe Storage encryption keys from the login keychain to decrypt saved browser credentials and cookies across thirteen Chromium-based browsers, alongside SSH and cloud credentials, Telegram session data, and roughly 21 desktop cryptocurrency wallet applications.
The chain then drops a native, statically-linked Mach-O remote access trojan, written in C++ and installed as a persistent LaunchAgent, giving the operator an interactive shell and file transfer capability over a hardcoded, TLS-wrapped command-and-control channel on a bare IP address. A separate, ad-hoc signed helper binary, disguised with the display name “Screen Recording”, is used specifically to acquire macOS’s screen-recording permission so the RAT can capture the victim’s display.
Wallet apps rewritten in place
The most consequential capability, Huntress said, targets hardware wallet companion software. Where Ledger Live, Ledger Wallet or Trezor Suite are found installed, MacSync downloads a modified application bundle, replaces the legitimate files in place, and re-signs the app with an ad-hoc signature so it continues to launch normally. When the victim next opens what they believe is their trusted wallet manager, the tampered app displays a convincing recovery-phrase entry screen and exfiltrates any seed phrase entered directly to attacker-controlled infrastructure.
Analysis of the Ledger payload found 26 of 30 unpacked files were byte-identical across builds badged for two different Ledger products, indicating a single patched payload was reused across targets rather than built bespoke per app, Huntress said.
Links to the AMOS/Atomic Stealer lineage
Huntress noted that the credential-theft component closely mirrors known tradecraft from the AMOS (Atomic Stealer) malware family, including its use of AppleScript, its dscl-based password validation loop, and its browser and wallet targeting list. Russian-language developer comments were found throughout the recovered source code. Huntress stopped short of formal attribution, describing the resemblance as a family relationship rather than a confirmed link to a named actor.
The firm was able to recover the full attack chain, including components that never touch a victim’s disk, because it reconstructed the loader’s network requests and pulled each stage directly from the attacker’s delivery servers after the original victim’s host was taken offline before analysts could collect artefacts locally.
Detection guidance
Huntress said file hashes and per-build identifiers change with every deployment and offer limited detection value on their own. It recommends defenders instead hunt for behavioural indicators, including curl commands piping base64-decoded content into zsh or osascript, LaunchAgent plists pointing to unsigned binaries disguised as Apple or third-party updater processes, screencapture invocations from non-Apple parent processes, and ad-hoc code signatures applied to applications that should carry a vendor signature, particularly cryptocurrency wallet software.
This is the third case Huntress has documented this year of malware distributed via poisoned search results pointing to AI-hosted “install guides”, following earlier campaigns abusing shared ChatGPT and Grok conversations to spread the AMOS stealer, and a fake Claude desktop malvertising campaign delivering the SectopRAT trojan.
Find out more here: https://www.huntress.com/blog/macsync-stealer-rat-reverse-engineering
