Reworked MacSync Stealer Adopts Quieter Installation Process

Jamf Threat Labs discovered a reworked MacSync Stealer variant for macOS that is distributed as a code-signed, notarized Swift application inside a deceptive disk image. The dropper performs connectivity and timing checks, downloads an encoded payload via an obfuscated curl invocation, removes quarantine attributes, executes largely in memory, and cleans up traces; the associated developer certificate was reported to Apple and revoked.