MacSync macOS Infostealer Exploits ClickFix-style Attack to Trick Users with Single Terminal Command

A sophisticated macOS infostealer campaign dubbed MacSync uses phishing redirects and a deceptive “Terminal installation” one-liner to install a multi-stage, script-driven payload that bypasses Gatekeeper. The AppleScript-based stealer exfiltrates browser profiles, Keychain contents, SSH/AWS/Kubernetes credentials, and cryptocurrency wallet data, and can persist by trojanizing Ledger and Trezor desktop apps to phish PINs and recovery phrases; multiple rotating C2 domains and unique build tokens indicate active, evolving operations.