Kaspersky Discovers New Variant of 'MacSync' Malware on macOS

Jakarta (ANTARA) - Kaspersky researchers have discovered a new version of the ‘infostealer’ malware on the macOS operating system, known as MacSync, which can jeopardise credentials, user data, and even crypto assets.

According to a Kaspersky press release on Monday, MacSync first appeared in 2024-2025 as a variant of the AMOS infostealer and has now undergone significant changes. The latest version, detected in September 2026, utilises a new, more complex infection chain to distribute infostealers and backdoors to victims’ devices.

The attack begins when a malicious file enters the user’s device. This can occur when users download malware disguised as specific applications, such as document-sharing apps, crypto wallet applications, or other software.

As a result of this infection, the core components of the MacSync malware—the infostealer and the backdoor—are installed on the device.

When executed, the infostealer appears to be the application the user originally intended to download. This application then prompts the user to enter their administrator account password.

Once the password is entered, a notification appears stating that the application is damaged and suggesting the user move it to the trash. This is a technique designed to distract the user.

Subsequently, the stealing malware collects data from web browsers, including browsing history, cookies, stored credentials, data from crypto wallet applications, data from Telegram messaging applications, device login information and passwords, as well as Keychain files.

The malware also collects lists of installed applications, device model and hardware data, SSH and ZSH configurations, and other data.

Specifically, through the backdoor, attackers can remotely distribute modified add-ons to the user’s web browser, which are likely used to replace legitimate crypto wallet extensions with malicious ones.

The backdoor can also be used to replace the original Ledger crypto wallet application with a malicious clone, collect system information or specific user files, and potentially execute arbitrary code for other purposes.

Kaspersky security expert Sergey Puzan stated that the latest version of MacSync has significant differences compared to previous versions, including new features and a more complex infection chain.

“Threat actors are also actively developing social engineering techniques that serve as the initial entry point into the victim’s device,” he said.

Puzan warned users to be cautious when installing new applications, especially those originating from untrusted developers.

Kaspersky advises users to ensure that downloaded or installed applications come from official developers and to verify their authenticity through trusted sources. Users are also urged to be wary of applications requesting administrator passwords, as such passwords can grant access to sensitive data and credentials on the device.