New MacSync Stealer Malware Attacking macOS Users Using Digitally Signed Apps

A new MacSync Stealer variant targets macOS users via a digitally signed and notarized fake installer (zk-call-messenger-installer-3.9.2-lts.dmg, signed with Apple Developer Team ID GNJLS3UYZ4). The Swift-based runtimectl helper checks connectivity, downloads a second-stage shell script from gatemaden.space, removes quarantine flags, sets execution permissions, rate-limits itself, deletes traces, and communicates with focusgroovy.com for additional payloads and C2, enabling silent data theft; Jamf reported the actor and Apple revoked the certificate.