Account-Draining Malware Spreading on Macbooks: Here Are the Signs
Mac users are currently facing a new malware threat capable of stealing various information, ranging from passwords to cryptocurrency assets.
Kaspersky researchers have discovered the latest version of the MacSync infostealer, which utilises more complex infection techniques to infiltrate victims’ devices. MacSync first emerged during 2024-2025 as one of the AMOS infostealer variants. However, the version detected in September 2026 has undergone significant changes, including the use of a new infection chain that combines an infostealer with a backdoor.
Attacks typically begin when victims download malicious files disguised as specific applications. Perpetrators may disguise the malware as document-sharing applications, crypto wallets, or other software. Once the file enters the device, the malware executes a series of processes to download and install other malicious components.
In several cases, researchers found that one of the files in the attack chain was inserted via public iCloud calendar entries using the .ics format.
Once installed, the MacSync infostealler component masquerades as the application the victim originally intended to download. The malware then prompts the victim to enter their administrator password. Once the password is provided, the application displays a notification suggesting the program is broken and asks the user to move it to the trash.
This technique is used to distract the victim while the malware continues its data theft activities on the device. MacSync can target various sensitive information. The collected data includes browsing history, cookies, and credentials stored in browsers, information from crypto wallet applications, Telegram data, login information and passwords, and even Keychain files.
The malware is also capable of collecting lists of installed applications, hardware and device model information, SSH and ZSH configurations, and various other data.
In addition to the infostealer, MacSync carries a backdoor component disguised as a Finder application. This component provides attackers with further access to control and extract data from the victim’s device. Through this backdoor, attackers can remotely install modified browser add-ons. Kaspersky suspects this capability could be used to replace crypto wallet extensions with malicious versions.
Attackers can also replace the original Ledger crypto wallet application with a malicious clone, capture system information or specific files, and potentially execute arbitrary code on the victim’s device.
Kaspersky security expert Sergey Puzan stated that the latest version of MacSync differs significantly from previous versions, particularly regarding its features and the complexity of the infection chain. “The latest version of the MacSync infostealer is very different from previous versions; it introduces new features and makes the infection chain more complex,” Puzan said in a written statement.
According to him, perpetrators are also continuously developing social engineering techniques to use users as the initial entry point to devices. “Threat actors are also actively developing social engineering techniques that serve as the initial entry point to victims’ devices,” he added.
Puzan warned users to be cautious when installing new applications, especially if they originate from unknown developers. “We advise you to always ensure that downloaded or installed applications come from official developers and to verify their authenticity through trusted sources,” he said.
He also highlighted requests for administrator passwords as something users should be wary of. “Your administrator password is the protective key for the most sensitive data and credentials on the device; users must be vigilant if an application requests it,” Puzan noted.