MacSync: The Evasive macOS Stealer Exploiting ClickFix Lures

## Executive Summary MacSync is a commercially available macOS information stealer (MaaS) distributed via ClickFix malvertising and social-engineering lures that executes a lightweight Mach-O stager which decrypts strings with single-byte XOR, streams remote AppleScript into osascript in-memory to harvest Keychain, browser cookies, SSH keys and crypto wallets, then splits stolen archives into 10 MB chunks for authenticated HTTP PUT exfiltration; the report includes static/dynamic analysis, persistence and anti-forensic behaviors, full IOCs (hashes, domains, API-key header), regional telemetry, and MITRE ATT&CK mappings.