MacSync — Six-Stage macOS Infostealer + RAT Delivered by a Fake Claude Install Guide

What the attacker wants: irreversible crypto theft, with a full credential haul as the consolation prize. Huntress counted roughly 60 wallet browser extensions, 21 desktop wallet apps and three trojanised hardware-wallet companion apps in the collection list. The keychain, browser cookies, Telegram sessions, SSH and cloud keys are all taken, but the weight of the kit sits on wallets, and the final stage waits for the victim to type their BIP39 recovery phrase into what looks like their own Ledger.

How it gets in: no exploit and no malicious file. The operator bought a Google Ads placement above the organic anthropic.com result for "how to install Claude on a Mac". The ad lands on a real claude.ai/share page — Anthropic's own domain, Anthropic's own certificate — carrying an operator-chosen "Shared by Apple Support" display name that the platform's own safety banner then repeats back to the reader as fact. The page tells the user to open Terminal and paste one command. That is the entire delivery mechanism.

Why it is worse than a commodity stealer: the stealer body never lands on the endpoint. Stage 3 is AppleScript served on demand from /dynamic behind an api-key gate and piped straight into osascript, so it can be changed at will and there is no file to hash. Stage 4 installs a statically-linked C++ Mach-O RAT with an interactive forkpty shell. Stage 5 rents a separately signed helper whose only job is to farm the Screen Recording TCC grant. Stage 6 rewrites the victim's own wallet apps in place and ad-hoc re-signs them.

The highest-value defensive angle: the per-build hashes and the per-delivery 8-hex identifiers change every build — the vendor says so explicitly and this pack agrees. Anchor on the behaviours: curl -k piped into zsh from an interactive Terminal; curl .../dynamic piped into osascript; a repeating dscl . authonly password oracle; a .hcpi binary under ~/.local with a .mpwd beside it; /usr/sbin/screencapture -x from a non-Apple parent; and an ad-hoc codesign -f -s - over a wallet bundle.

Defender priority: a confirmed hit means the account password was validated in plaintext, the keychain was opened with it, and every browser session cookie is in attacker hands. Treat the host as fully compromised and reimage. Critically, removing the malware does not fix the wallet — Ledger Wallet.app, Ledger Live.app and Trezor Suite.app are rewritten on disk and will keep phishing the seed phrase. Any host where a seed phrase may have been entered needs funds moved to a wallet derived from a new seed, generated on a clean device. Possession of the phrase is permanent possession of the wallet.

Research decisions

• Two waves, kept separate. The Huntress report and the Cyber Security News report describe the same malware family on different delivery infrastructure (agenticsora[.]com/malwareaudit[.]com versus hybridcustomhomes[.]com and siblings, and two different api-key values). Both sets ship, but the CSV tags them wave:huntress and wave:csn so a hit tells you which build you are looking at.
• One hash was dropped. The Cyber Security News IOC table lists a 66-character "SHA-256" — two characters too long for a valid SHA-256. It is a transcription error at the source, so it is not shipped in any form. The other hash in that table is well-formed and is included.
• Two IPs are deliberately not blockable. 104.21.40.24 and 172.67.174.150 are published as "C2 IPs" in the second-wave reporting, but both are shared Cloudflare edge addresses. They appear in the IOC table for context only, marked enrich, and are excluded from the import CSV. Blocking them would break a large fraction of the internet and would not touch the operator.
• Per-build artifacts are shipped as shapes, not values. The 8-hex identifier (54a28156, 6c66fd27, dbfc21d4, a3b73d35 are the four observed) regenerates per delivery, as does the loader's outer hash. Every query anchors on the shape com.apple.<8hex>.hcpi rather than a value.
• Overlap with the existing AMOS pack. Stage 3 is largely the AMOS/Atomic playbook — osascript body, fake password prompt validated by dscl . authonly, Safe Storage keys out of the login keychain, ditto to /tmp/osalogging.zip. This pack is not a duplicate: stages 4 through 6 (the Mach-O RAT, the TCC capture helper, and the wallet-app rewrite) have no counterpart in the AMOS pack and carry most of the detection value here.
• No prompt-injection content was found in any fetched source. All four are ordinary security journalism and vendor analysis. The attacker's own lure text and code are quoted inside the Huntress report as evidence; they were read as data and none of it was acted on.

Hunt hypotheses

Attack chain

Persistence bug worth exploiting. The stealer's own cleanup of the ~/.zshrc line is broken: grep -Fvx <cmd> /tmp/.zshrc > /tmp/.zshrc.tmp || mv … only fires the mv when grep matches nothing, so on any real profile the filtered copy is written and then ignored. On a second failed run the backup already contains the one-liner and the restore puts it straight back. Read ~/.zshrc on every host where the Full Disk Access pane opened more than once — on that path the "self-cleaning" persistence does not clean itself.

Network — wave 1 (Huntress-reported)

Network — wave 2 (separately reported, same family)

File hashes (SHA-256)

The stage 1 loader is deliberately absent from this table. Its outer hash is unique per build by design — the token change alters the compressed byte stream and the wrapper randomises its own variable name and heredoc delimiter — so a loader hash is worth nothing. Hunt it with Q1 instead.

Host and file-system artifacts

The LaunchAgent label is not always com.apple.. The installer carries a list of genuine updater labels — Google Keystone, Adobe ARM and Creative Cloud, Microsoft AutoUpdate and OneDrive, Dropbox, Spotify, Grammarly, JetBrains Toolbox — and picks the first one whose plist already exists on the host, hiding behind whatever updater the victim happens to run. It only falls back to com.apple.<8hex> when it matches none of them. The second-wave reporting shows exactly this, with persistence at Library/LaunchAgents/com.google.keystone.agent.plist. Detection that keys solely on the com.apple. prefix will miss the impersonating copies — anchor on the ~/.local .hcpi drop and the paired .mpwd instead.

Web proxy / secure web gateway

• The ad hop is a durable artifact. A sponsored click never goes straight to the destination — it passes through Google's ad-click redirect, a URL with aclk in the path carrying a gclid. Hunt proxy logs for an aclk hop immediately followed by a claude.ai/share/ request. An organic click leaves neither. The wave-1 buy carried gad_campaignid=23991223358; the second-wave reporting names campaign 23936394455.
• POST bodies to /modules/wallets containing a seedwords array. If your gateway inspects request bodies, this is the highest-fidelity single signature available anywhere in the chain — nothing legitimate looks like it.
• Requests carrying a static api-key header equal to 9dd465d26c7d86b4a6f514a4b46b2295 (wave 1) or 5190ef1733183a0dc63fb623357f56d6 (wave 2).
• Plain-HTTP requests to /curl/ or /dynamic?txd= from a macOS user agent, or a spoofed macOS/Chrome UA fetching app.asar.

macOS host audit (push via MDM — see S13)

• ~/.zshrc on every host where the Full Disk Access pane opened more than once — the stealer's restore logic is broken and leaves the re-pull line in place on that path.
• Every plist in ~/Library/LaunchAgents whose ProgramArguments point into ~/.local, regardless of the label. The label may impersonate Keystone, Adobe ARM, Microsoft AutoUpdate, OneDrive, Dropbox, Spotify, Grammarly or JetBrains Toolbox.
• Code-signature status of every wallet app: codesign -dvv on Ledger Wallet.app, Ledger Live.app and Trezor Suite.app. An ad-hoc signature with no Team ID on an app that ships with a vendor signature is conclusive.
• TCC review: any Screen Recording grant held by a bundle identifier under com.apple.* that is not shipped by Apple.
• Shell history for the pasted one-liner shape: base64 -D inside a command substitution feeding curl, piped to zsh.

Identity and SaaS

• Assume every browser session cookie on the host is replayable. Hunt your IdP for sessions resumed from a new ASN or geography without a fresh MFA event, for accounts belonging to any user on a hit host.
• Review source-control and CI/CD activity for those users — SSH keys, cloud credentials, kubeconfig and package-publishing tokens were all in scope of the collection.

No query carries an in-query time filter. Set the window with the console's time picker — the intent is recorded as a // LOOKBACK: comment on each card. All ten are macOS-only and filter on event_platform=Mac; basenames are matched via FileName so no path separator has to be escaped inside a regex.

// HUNT: MacSync stage 1 — curl -k (TLS verification off) pasted into an interactive Terminal
// MITRE: T1059.004, T1105, T1140, T1204
// CONF: high  FP: low  COST: low | REQUIRES: Falcon for macOS ProcessRollup2
// LOOKBACK: 30d — set the window in the console time picker
// FALSE POSITIVES: rare dev bootstraps that disable cert checks behind a corporate MITM proxy
// TUNING: exclude ComputerName of known build agents, and CommandLine matching your internal artifact host
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| event_platform=Mac
| ParentBaseFileName=/^(Terminal|iTerm2|zsh|bash|sh|login|Script Editor|osascript)$/i
| (FileName=/^curl$/i and CommandLine=/\s-{1,2}[a-zA-Z]*k[a-zA-Z]*(\s|$)/) or (FileName=/^base64$/i and CommandLine=/\s(-D|-d|--decode)(\s|$)/) or CommandLine=/curl.*\|\s*(zsh|bash|sh)\b/i
| table([@timestamp, ComputerName, aid, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

// HUNT: MacSync stage 2 — curl .../dynamic piped to osascript (server-side stealer body)
// MITRE: T1059.002, T1105
// CONF: high  FP: medium  COST: low | REQUIRES: ProcessRollup2 (macOS)
// LOOKBACK: 30d — set the window in the console time picker
// FALSE POSITIVES: MDM/automation osascript, packaged apps invoking osascript from a helper shell
// TUNING: exclude ParentBaseFileName of your MDM agent (jamf, Munki, kandji) and known automation CommandLine
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| event_platform=Mac
| (FileName=/^osascript$/i and ParentBaseFileName=/^(zsh|bash|sh|curl|Terminal|iTerm2|login)$/i) or CommandLine=/\/dynamic\?txd=/i or CommandLine=/curl.*\|\s*osascript/i
| table([@timestamp, ComputerName, aid, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

// HUNT: MacSync stage 3 — dscl . authonly loop behind the fake System Preferences password prompt
// MITRE: T1056.002, T1204, T1555
// CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2 (macOS)
// LOOKBACK: 30d — set the window in the console time picker
// FALSE POSITIVES: admin/helpdesk scripts that validate a credential once
// TUNING: investigate any host with more than a couple of attempts; single events are usually benign admin tooling
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| event_platform=Mac
| FileName=/^dscl$/i
| CommandLine=/authonly/i
| groupBy([ComputerName, aid, UserName, ParentBaseFileName], function=[count(as=AuthOnlyAttempts), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=500)
| sort(AuthOnlyAttempts, order=desc, limit=200)

// HUNT: MacSync stage 3 — Safe Storage key extraction + keychain unlock with the captured password
// MITRE: T1555.001, T1555.003, T1552.001
// CONF: high  FP: medium  COST: medium | REQUIRES: ProcessRollup2 (macOS)
// LOOKBACK: 30d — set the window in the console time picker
// FALSE POSITIVES: password managers, MDM enrolment helpers and CI agents reading their own keychain items
// TUNING: exclude ParentBaseFileName of approved password managers and your MDM agent; the /tmp/.kgrab.sh and /tmp/.kpwd branches need no tuning
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| event_platform=Mac
| CommandLine=/\/tmp\/\.(kgrab\.sh|kpwd)/i or CommandLine=/Safe Storage/i or (FileName=/^security$/i and CommandLine=/(unlock-keychain|dump-keychain|find-generic-password)/i)
| table([@timestamp, ComputerName, aid, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

// HUNT: MacSync stage 3 — macsync_*.lock mutex, /tmp/sync* staging, ditto to /tmp/osalogging.zip
// MITRE: T1074.001, T1560.001, T1005, T1070.004
// CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2 (macOS)
// LOOKBACK: 30d — set the window in the console time picker
// FALSE POSITIVES: essentially none — every string here is specific to this kit
// TUNING: none needed; investigate every hit and correlate with Q1 and Q2 on the same aid
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| event_platform=Mac
| CommandLine=/\/tmp\/macsync_/i or CommandLine=/osalogging\.zip/i or CommandLine=/\/tmp\/sync[0-9]/i or (FileName=/^ditto$/i and CommandLine=/sequesterRsrc/i) or (FileName=/^system_profiler$/i and CommandLine=/SPDisplaysDataType/i)
| table([@timestamp, ComputerName, aid, UserName, ParentBaseFileName, FileName, CommandLine], limit=max)

// HUNT: MacSync stage 4 — ~/.local/com.apple.<8hex>.hcpi RAT, .mpwd handoff, PlistBuddy LaunchAgent
// MITRE: T1543.001, T1036, T1552.001, T1105
// CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2 (macOS)
// LOOKBACK: 30d — set the window in the console time picker
// FALSE POSITIVES: legitimate installers occasionally build LaunchAgents with PlistBuddy
// TUNING: exclude PlistBuddy invocations whose ParentBaseFileName is your MDM agent or a signed vendor installer; the .hcpi and .mpwd branches need no tuning
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| event_platform=Mac
| CommandLine=/\.hcpi/i or CommandLine=/\/loader\/(agent|capture-agent)\//i or CommandLine=/\.local\/\.mpwd/i or (FileName=/^PlistBuddy$/i and CommandLine=/(RunAtLoad|KeepAlive|ProgramArguments)/i)
| table([@timestamp, ComputerName, aid, UserName, ParentBaseFileName, FileName, CommandLine], limit=max)

// HUNT: MacSync stage 5 — screencapture -x from the signed 'Screen Recording' helper, plus TCC markers
// MITRE: T1113, T1548, T1036
// CONF: medium  FP: medium  COST: low | REQUIRES: ProcessRollup2 (macOS)
// LOOKBACK: 30d — set the window in the console time picker
// FALSE POSITIVES: remote-support and screen-recording tools, and user-initiated screenshots
// TUNING: exclude ParentBaseFileName of approved remote-support agents; the /tmp/.com.apple.tcc.* and .capture.app branches need no tuning
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| event_platform=Mac
| (FileName=/^screencapture$/i and CommandLine=/\s-[a-zA-Z]*x/) or CommandLine=/\/tmp\/\.com\.apple\.tcc\.(prompted|result)/i or CommandLine=/\.capture\.app/i or CommandLine=/tcc-only/i
| ParentBaseFileName!=/^(SystemUIServer|loginwindow|Screenshot|Dock)$/i
| table([@timestamp, ComputerName, aid, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

// HUNT: MacSync stage 6 — Ledger/Trezor bundle rewrite, app.asar swap, ad-hoc codesign, recovery-step phishing pages
// MITRE: T1554, T1553, T1056.002, T1036
// CONF: high  FP: medium  COST: medium | REQUIRES: ProcessRollup2 (macOS)
// LOOKBACK: 30d — set the window in the console time picker
// FALSE POSITIVES: developers ad-hoc signing their own builds; Electron app self-updates rewriting app.asar
// TUNING: exclude developer ComputerName groups for the bare codesign branch; a codesign or asar hit that also names a wallet bundle is never benign
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| event_platform=Mac
| CommandLine=/(Ledger Wallet|Ledger Live|Trezor Suite)\.app/i or CommandLine=/recovery-step-/i or CommandLine=/app\.asar/i or (FileName=/^codesign$/i and CommandLine=/-f\s+-s\s+-(\s|$)/) or (FileName=/^xattr$/i and CommandLine=/-[a-zA-Z]*cr?(\s|$)/)
| table([@timestamp, ComputerName, aid, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

// HUNT: MacSync infrastructure — delivery, operator panel, RAT C2 (8443/TLS), seed-phrase drops
// MITRE: T1071.001, T1571, T1573.002, T1041, T1567
// CONF: high  FP: low  COST: low | REQUIRES: DnsRequest + NetworkConnectIP4 (macOS)
// LOOKBACK: 90d — infrastructure is the longest-lived signal here; widen the console window
// FALSE POSITIVES: none expected — these hosts are attacker-registered, not shared services
// TUNING: none. Do NOT add 104.21.40.24 or 172.67.174.150 — those are shared Cloudflare edge IPs, not operator infrastructure
#event_simpleName=/DnsRequest|NetworkConnectIP4/
| event_platform=Mac
| DomainName=/(^|\.)(agenticsora|malwareaudit|sdhomeinspectors|southcarolinacounselor|hybridcustomhomes|houstongaragedoorinstallers|mansfieldpediatrics)\.com$/i or RemoteAddressIP4=/^(85\.206\.161\.241|103\.216\.221\.95)$/
| table([@timestamp, ComputerName, aid, UserName, DomainName, RemoteAddressIP4, RemotePort, ContextBaseFileName], limit=max)

// HUNT: MacSync stage 3 — Full Disk Access pane opened programmatically + ~/.zshrc re-pull persistence
// MITRE: T1204, T1548, T1546, T1140
// CONF: medium  FP: medium  COST: low | REQUIRES: ProcessRollup2 (macOS)
// LOOKBACK: 30d — set the window in the console time picker
// FALSE POSITIVES: dotfile managers (chezmoi, yadm), oh-my-zsh installers and shell-config automation
// TUNING: exclude ParentBaseFileName of your dotfile tooling; the Privacy_AllFiles and killall-Terminal branches need no tuning
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| event_platform=Mac
| CommandLine=/Privacy_AllFiles/i or CommandLine=/\/tmp\/\.zshrc/i or (FileName=/^killall$/i and CommandLine=/Terminal/i) or (FileName=/^(cp|mv|tee|grep)$/i and CommandLine=/zshrc/i)
| table([@timestamp, ComputerName, aid, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

Promotion candidates from the hunt queries above. Platform macOS, Process Create rule type unless noted.

Q3's value is in the aggregation, not a single event, so it deploys best as a scheduled search rather than a Process-Create IOA. Q9 belongs in Falcon IOC Management (S10 CSV) rather than as an IOA.

One-click copy blocks for ingestion. Every atomic value below traces to a saved source snapshot. The two Cloudflare edge IPs from the second-wave reporting are deliberately absent from the CSV — see S4.

type,value,action,severity,expiration,description,tags
domain,agenticsora.com,detect,critical,2027-02-01,MacSync delivery C2 (loader/stealer/agent/wallet payloads),campaign:MacSync|wave:huntress
domain,malwareaudit.com,detect,critical,2027-02-01,MacSync second delivery domain same kit,campaign:MacSync|wave:huntress
ipv4,85.206.161.241,detect,critical,2027-02-01,MacSync RAT C2 raw-IP TLS WebSocket port 8443,campaign:MacSync|wave:huntress
ipv4,103.216.221.95,detect,high,2027-02-01,MacSync operator panel IP from stage 3 beacon,campaign:MacSync|wave:huntress
domain,main.sdhomeinspectors.com,detect,critical,2027-02-01,MacSync Ledger seed-phrase drop /modules/wallets,campaign:MacSync|wave:huntress
domain,main.southcarolinacounselor.com,detect,critical,2027-02-01,MacSync Trezor seed-phrase drop /modules/wallets,campaign:MacSync|wave:huntress
domain,sdhomeinspectors.com,detect,high,2027-02-01,MacSync seed-drop apex attacker-registered,campaign:MacSync|wave:huntress
domain,southcarolinacounselor.com,detect,high,2027-02-01,MacSync seed-drop apex attacker-registered,campaign:MacSync|wave:huntress
domain,hybridcustomhomes.com,detect,high,2027-02-01,MacSync second-wave delivery C2,campaign:MacSync|wave:csn
domain,houstongaragedoorinstallers.com,detect,high,2027-02-01,MacSync second-wave sibling domain,campaign:MacSync|wave:csn
domain,mansfieldpediatrics.com,detect,high,2027-02-01,MacSync second-wave sibling domain,campaign:MacSync|wave:csn
sha256,3db8befc08dc02ab7a76b5193abd81653775e8f3ceac5864c7c2188b2dbd3c54,detect,critical,2027-02-01,MacSync stage 3 dynamic AppleScript stealer,campaign:MacSync
sha256,3ae26ed89d3a1a140edc89ca78513aba2895789ed0d0f64cad6605b6f2347c7e,prevent,critical,2027-02-01,MacSync stage 4 agent RAT universal Mach-O,campaign:MacSync
sha256,78dea0693ac2d70bdf8be7588667a75910e43fd84397ad484e710e37369a30f7,prevent,critical,2027-02-01,MacSync stage 5 capture agent bundle,campaign:MacSync
sha256,9c09c303fa058c2d3e179969bd58ca5523775ff2d310fb2f8266ac74cb21ee81,prevent,critical,2027-02-01,MacSync stage 5 ScreenCap Mach-O,campaign:MacSync
sha256,071bd109208eb1080ef525b5be394244cec467c59ffef5b8782cfb5e4850401d,prevent,critical,2027-02-01,MacSync Ledger Wallet trojan payload,campaign:MacSync
sha256,31566a1df7070f30cb990aa5eab310c1d4e0266c8776e9438138e5438ec1cff8,prevent,critical,2027-02-01,MacSync Ledger Live trojan payload,campaign:MacSync
sha256,230dff4bf9442a951dcd6898b2110924969a20668c20a43e3ceed6fcef65963e,prevent,critical,2027-02-01,MacSync Trezor Suite trojan payload,campaign:MacSync
sha256,ae89034f81cb488b67a27ebe66e21a5a60098a6dc7271dd18be883bf221b02bf,detect,high,2027-02-01,MacSync second-wave payload,campaign:MacSync|wave:csn
# Loader hash intentionally omitted: the stage 1 wrapper is per-build polymorphic. Hunt it with Q1.
# HTTP api-key header values (not importable as IOCs, use in proxy rules):
#   9dd465d26c7d86b4a6f514a4b46b2295   wave 1
#   5190ef1733183a0dc63fb623357f56d6   wave 2

parent Terminal|iTerm2|zsh -> curl with -k (TLS verify off)   # stage 1
curl ... /dynamic?txd= | osascript                            # stage 2
dscl . authonly <user> <guess>  repeated on one host          # stage 3 password oracle
security find-generic-password -w -s "* Safe Storage"         # stage 3 browser keys
security unlock-keychain -p "$(cat /tmp/.kpwd)"               # stage 3 keychain fallback
mkdir /tmp/macsync_<token>.lock                               # stage 3 mutex
ditto -c -k --sequesterRsrc <staging> /tmp/osalogging.zip     # stage 3 archive
curl .../loader/agent/<token> -o ~/.local/*.hcpi              # stage 4 RAT drop
PlistBuddy -c 'Add ...' with RunAtLoad + KeepAlive            # stage 4 persistence
/usr/sbin/screencapture -x   parent not SystemUIServer        # stage 5 capture
codesign -f -s -   over a /Applications wallet bundle         # stage 6 re-sign
POST /modules/wallets  body contains a seedwords array        # stage 6 exfil
LaunchAgent ProgramArguments pointing into ~/.local           # label may impersonate a vendor updater

MacSync Stealer — self-branded "Build 1", version 1.1.2_release (x64_86 & ARM)
Lineage:   AMOS / Atomic Stealer family resemblance (not a named-actor attribution)
Delivery:  Google Ads -> claude.ai/share lure badged "Shared by Apple Support"
Stage 1:   1,442-byte zsh wrapper, gzip+base64 heredoc, eval'd; per-build polymorphic
Stage 2:   daemon_function -> /dynamic?txd= | osascript ; chunked PUT to /gate
Stage 3:   ~46 KB AppleScript, never on disk; FDA gate; dscl authonly oracle
Stage 4:   C++ universal Mach-O, ad-hoc signed, static OpenSSL 3.6.2, AES-256-CBC
           over WebSocket/TLS to 85.206.161[.]241:8443 ; forkpty interactive shell
Stage 5:   ScreenCap in com.apple.<8hex>.capture.app, CFBundleName "Screen Recording"
Stage 6:   Ledger Wallet / Ledger Live / Trezor Suite rewritten in place, re-signed
Endpoints: /curl/<token> /dynamic?txd= /gate?buildtxd= /loader/agent/<token>
           /loader/capture-agent/<token> /ledger/<token> /trezor/<token> /modules/wallets
Observed 8-hex build ids: 54a28156, 6c66fd27, dbfc21d4, a3b73d35 (per-delivery, not IOCs)

# 1. Implant + persistence (label may NOT be com.apple.*)
ls -la ~/.local/*.hcpi ~/.local/.mpwd 2>/dev/null
grep -l "$HOME/.local" ~/Library/LaunchAgents/*.plist 2>/dev/null
# 2. Staging + TCC markers (usually already deleted; absence proves nothing)
ls -la /tmp/macsync_* /tmp/sync* /tmp/osalogging.zip \
       /tmp/.kgrab.sh /tmp/.kpwd /tmp/.com.apple.tcc.* 2>/dev/null
# 3. Broken persistence cleanup — read this on ANY host where the FDA pane opened twice
grep -nE 'curl.*\|[[:space:]]*zsh|base64 -D' ~/.zshrc /tmp/.zshrc 2>/dev/null
# 4. Wallet bundle integrity — ad-hoc signature with no Team ID is conclusive
for a in "Ledger Wallet" "Ledger Live" "Trezor Suite"; do
  [ -d "/Applications/$a.app" ] && codesign -dvv "/Applications/$a.app" 2>&1 | \
    grep -E 'Signature|TeamIdentifier|Authority'
done
find /Applications -name 'recovery-step-*' -maxdepth 4 2>/dev/null
# 5. Screen Recording grants held by a non-Apple bundle claiming an Apple identifier
sqlite3 "$HOME/Library/Application Support/com.apple.TCC/TCC.db" \
  'select client,auth_value from access where service="kTCCServiceScreenCapture"' 2>/dev/null

A · Enforce Gatekeeper and deny ad-hoc signed code (MDM configuration profile)

Every MacSync payload is ad-hoc signed with no Team ID. Deploy this com.apple.systempolicy.control payload through Jamf, Intune or Kandji:

<!-- profile payload: com.apple.systempolicy.control -->
<key>PayloadType</key><string>com.apple.systempolicy.control</string>
<key>EnableAssessment</key><true/>
<key>AllowIdentifiedDevelopers</key><true/>
<!-- prevent users disabling Gatekeeper from the command line -->
<key>AllowUserOverrides</key><false/>

B · Pre-approve Full Disk Access and Screen Recording, deny the rest (PPPC profile)

Stage 3 needs FDA and stage 5 needs Screen Recording. Both arrive only by talking a user through a prompt. A managed PPPC payload means the prompt never appears for anything you did not approve:

<!-- payload: com.apple.TCC.configuration-profile-policy -->
<!-- Services: SystemPolicyAllFiles (FDA), ScreenCapture -->
<!-- Allow ONLY the identifiers your fleet genuinely needs, e.g. -->
<key>Identifier</key><string>com.your.backup.agent</string>
<key>IdentifierType</key><string>bundleID</string>
<key>CodeRequirement</key><string>identifier "com.your.backup.agent" and anchor apple generic and certificate leaf[subject.OU] = "TEAMID"</string>
<key>Allowed</key><true/>
<!-- Do NOT grant SystemPolicyAllFiles to com.apple.Terminal on standard fleets -->

C · Wallet bundle integrity check (shell — schedule via MDM)

#!/bin/zsh
# Flags an in-place rewrite of a hardware-wallet companion app.
# An ad-hoc signature (no TeamIdentifier) on a vendor app is conclusive.
for app in "Ledger Wallet" "Ledger Live" "Trezor Suite"; do
  p="/Applications/$app.app"
  [ -d "$p" ] || continue
  out=$(codesign -dvv "$p" 2>&1)
  echo "$out" | grep -q 'TeamIdentifier=not set' && echo "SUSPECT ad-hoc signature: $p"
  echo "$out" | grep -q 'Signature=adhoc'        && echo "SUSPECT ad-hoc signature: $p"
  find "$p" -name 'recovery-step-*' -print 2>/dev/null | \
    sed 's/^/SUSPECT injected phishing page: /'
done

D · Fleet sweep for the implant and its persistence (shell — push via MDM)

#!/bin/zsh
# The LaunchAgent LABEL is unreliable: it impersonates Keystone, Adobe ARM,
# Microsoft AutoUpdate, OneDrive, Dropbox, Spotify, Grammarly or JetBrains
# when one of those plists already exists. Anchor on the ~/.local target instead.
for u in /Users/*; do
  [ -d "$u" ] || continue
  ls -la "$u"/.local/*.hcpi "$u"/.local/.mpwd 2>/dev/null
  grep -l "$u/.local" "$u"/Library/LaunchAgents/*.plist 2>/dev/null
  grep -nE 'curl.*\|[[:space:]]*zsh|base64 -D' "$u"/.zshrc 2>/dev/null
done
ls -la /tmp/macsync_* /tmp/sync* /tmp/osalogging.zip /tmp/.com.apple.tcc.* 2>/dev/null

E · Credential and asset rotation checklist (post-compromise)

# Treat ALL of the following as exfiltrated on any confirmed host.
# The account password was VALIDATED in plaintext, so it is known-good to the operator.
#  1. macOS account password  -> change from a clean device, then change again after reimage
#  2. Login keychain items    -> every stored secret; the keychain was unlocked with (1)
#  3. Browser sessions        -> force global sign-out; cookies bypass MFA entirely
#  4. Browser saved logins    -> rotate; Safe Storage keys were stolen alongside them
#  5. SSH keys (~/.ssh)       -> revoke, reissue, prune authorized_keys everywhere
#  6. Cloud creds (~/.aws)    -> rotate access keys, revoke active STS sessions
#  7. Kubeconfig (~/.kube)    -> rotate cluster credentials and service-account tokens
#  8. Telegram sessions       -> terminate all other sessions from the app
#  9. Package/CI tokens       -> revoke PATs, review publish and pipeline history
# 10. CRYPTO — the one that is not reversible:
#     move funds to a wallet derived from a NEW seed generated on a clean device.
#     Reinstalling the wallet app does NOT help if the phrase was ever entered.

Validation: the spine of this pack is strong. Q5, Q6 and Q9 are near-zero FP and each catches a stage the victim cannot reverse; treat any hit on those three as an incident rather than a tuning exercise, and work Gate 4 (negative control) in S11 before promoting anything. Q2, Q7, Q8 and Q10 need one baselining pass each — MDM automation, remote-support tooling, developer code-signing and dotfile managers respectively — and every one of those exclusions belongs in the card's // TUNING: line, not in a runbook. Three genuine gaps remain and none are closeable with endpoint telemetry: the malvertising hop lives in proxy logs (S7), direct file reads of browser profiles depend on your sensor's file-event policy, and the RAT's C2 payload is encrypted inside an encrypted channel so only the destination is ever visible. The compensating control for all three is the S12 near-term tier — managed TCC, enforced Gatekeeper, and egress inspection — which removes the attacker's prerequisites rather than trying to observe the consequence.

Source snapshots for all four reporting sources are archived alongside this pack in MacSync-Stealer-macOS-Hunt-sources/. Every atomic indicator shipped in S10 was traced against those snapshots before publication.