MacSync under the microscope: new delivery methods and a new payload
MacSync is a relatively young, rapidly evolving family of crypto/info stealers. First advertised on the dark web in 2025 as Mac.c, the stealer was later renamed to MacSync by its creators. The initial versions were implemented as AppleScripts and closely resembled the AMOS stealer family, but over time, MacSync developed distinctive features of its own, including a backdoor module.
Summary from Kaspersky Securelist.
Explained
The technology and terms in this story. Learn more