MacSync Stealer: macOS Infostealer Poses as Claude Install Guide, Trojanizes Hardware Wallet Apps
Microsoft discloses MacSync Stealer posing as a Claude install tutorial to steal macOS data, and trojanizing Ledger/Trezor suites to steal seed phrases.
Microsoft Security and CIS Cyber Threat Intelligence disclosed MacSync Stealer (v1.1.2_release) on 18 Aug 2026, an advanced macOS infostealer. The family SEO-poisons victims onto a fake Claude AI install tutorial, bypasses multiple native macOS defenses, then steals Keychain data, browser credentials, crypto wallet extensions, and specifically trojanizes Ledger Live and Trezor Suite to replace the launch path and steal seed phrases. MacSync Stealer shares lineage with AMOS/Atomic Stealer, uses Russian comments and three-tier infrastructure (Cloudflare-fronted domains + operator IP + direct TLS channel). Among the most dangerous macOS infostealers of 2026.
Incident Overview
Huntress found MacSync Stealer investigating a macOS intrusion: victim Googled "how to install Claude on Mac", malicious ad redirected to `agenticsora[.]com`. Page impersonates a Claude AI official share page; actually a fake install guide that tells the user to paste a Base64-encoded curl command into Terminal. Command fetches a remote zsh loader, then chains multi-stage AppleScript and a Mach-O trojan, minimizing disk writes—standard MaaS macOS attack template. Microsoft Security and CIS CTI disclosed the same day (18 Aug) and issued an SLTT government advisory.
Technical Details
- Delivery: SEO poisoning → malvertising → fake `claude.ai/share` install page → Base64 + gzip, piped from curl to zsh → fetch AppleScript stage 2.
- Stage 2: returned AppleScript prompts Full Disk Access, calls `dscl` to verify macOS account password (discarded immediately after), reads Chromium Safe Storage Key from Keychain, then serially accesses browser cookies, logins, SSH/cloud keys, Apple Notes.
- Stage 3: LaunchAgent deploys a statically linked Mach-O RAT, impersonating Google Keystone / Adobe ARM and similar legitimate updaters; WebSocket over TLS to a hardcoded IP.
- Hardware wallets: drops binaries impersonating Ledger Live / Trezor Suite under `%LocalAppData%\Microsoft\OneDrive\` and similar user dirs; on run, fake recovery flow lures 12/24-word seed phrase. Huntress observed 21 desktop wallets and 3 hardware-wallet companion apps trojanized.
- Persistence: appends curl to `~/.zshrc`; LaunchAgent starts RAT at login.
- Infra: Cloudflare fronts (agenticsora[.]com, malwareaudit[.]com) + operator IP 103.216.221[.]95 + direct TLS 85.206.161[.]241:8443; Russian comments, self-branded `MacSync Stealer v1.1.2_release`; same TTPs as AMOS/Atomic Stealer.
Impact
MacSync Stealer upgrades macOS attacks from data theft to permanent crypto-asset theft:
- Targeted crypto harvest: 60+ browser wallet extensions + 21 desktop wallets + 3 hardware-wallet companion apps. Entering a seed phrase equals total asset loss; seeds cannot be reset; loss is irreversible.
- macOS trust chain abused: browser, Keychain, SSH/cloud keys, Apple Notes, LaunchAgent—full stack. Infected enterprise macOS workstations become persistent pivot points.
- MaaS scale: rentable family; affiliates arbitrage SEO poison + AI-brand impersonation. Targets expand from consumers to U.S. SLTT government (CIS confirmed).
- Detection stacked: ClickFix + multi-stage + in-memory exec + legitimate process names + Cloudflare fronting. Hard for EDR and macOS XProtect to catch on a single signature.
Remediation
End users
- Download Claude, ChatGPT, and other AI clients from official channels only. Treat any "install guide" that asks you to paste curl into Terminal as hostile.
- In System Settings, audit Full Disk Access, Accessibility, Screen Recording grants; revoke unknown entries immediately.
- Periodically inspect `~/Library/LaunchAgents/` and `~/.zshrc`; remove suspects. Watch for suspicious DLLs under legitimate names like OneDrive/Adobe ARM.
- Hardware-wallet users: verify launch source. Download Ledger Live/Trezor Suite from vendor sites only. Never install via ad links or "tutorial" commands.
Enterprise IT
- MDM: restrict Full Disk Access / Accessibility grant flows on macOS; force XProtect and MRT updates.
- SIEM: block and alert on IoCs `agenticsora[.]com`, `malwareaudit[.]com`, IP 103.216.221[.]95, 85.206.161[.]241.
- macOS EDR: detect osascript, curl|zsh, pipe-to-osascript; cross-process trace suspicious launches.
- Hardware-wallet holders (exec/finance/blockchain teams): targeted advisory—do not install wallet clients on work devices.
Detection and response
- Watch curl lines at the end of ~/.zshrc; hunt paths like `%LocalAppData%\Microsoft\OneDrive\wtsapi32.dll`.
- Review LaunchAgent and LaunchDaemon lists; remove any persistence not required by business.
- On MacSync Stealer traces: immediately isolate, forensic backup offline, check whether wallet assets were moved.
References
- Microsoft Security: MacSync Stealer behavior tracing
- Huntress: MacSync Stealer RAT reverse analysis
- CyberPress: MacSync Stealer full-chain analysis
- Fraunhofer Malpedia: MacSync Stealer profile