MacSync Stealer, the Mac malware that has evolved into a silent threat notarized by Apple

MacSync Stealer malware has evolved to become a silent threat to Apple computers, where it is installed under the guise of an application written in Swift, signed and notarized by the technology company before deploying its malicious actions.

MacSync Stealer is a ‘malware’ designed to steal information from infected Mac computers, which is usually installed on the victim’s computer with techniques similar to those of ClickFix, by ‘copying and pasting’ malicious code.

A new variant has surpassed this technique, which requires action on the part of the victim, to adopt a hands-off approach, which manages to trick the user by presenting itself as a legitimate application for Apple, such as a messaging service.

The ‘malware’ is, in the first phase, an application written in Swift, Apple’s programming language, which has a signature associated with a developer’s ID and has been notarized by the technology company itself.

The application is distributed in a large disk image (25.5 MB) which, as Jamf Threat Labs explains in an analysis, “appears to be inflated by decoy files embedded in the application package.”

Once executed on the computer, the ‘malware’ performs an analysis of the environment, including the Internet connection, to determine if everything is in order to connect to a server and download and install the malicious code in a second phase.

“This change in distribution reflects a broader trend in the macOS malware landscape, where attackers are increasingly trying to insert their malware into signed and notarized executables, allowing them to simulate legitimate applications. By leveraging these techniques, attackers reduce the chances of being detected in time,” said analysts at Jamf Threat Labs.

After being informed by the cybersecurity company, Apple has revoked the certification of the developer team ID.