MacSync macOS Infostealer Leverage ClickFix-style Attack to Trick Users Pasting a Single Terminal Command

MacSync is a script-driven macOS infostealer (offered as Malware-as-a-Service) that uses deceptive landing pages and a one-line Terminal command to bypass Gatekeeper and deploy a Zsh loader and AppleScript payload; it harvests cryptocurrency-related data (browser wallet extensions, desktop wallets, seed phrases, private keys), SSH keys, Keychain entries and credentials, and can trojanize hardware wallet apps to capture PINs and recovery phrases, with multiple rotating C2 domains indicating an active, scalable campaign.