MacSync Stealer Spreads Through ClickFix Social Engineering
Security researchers discovered three distinct ClickFix campaigns on March 16, 2026, distributing MacSync information stealer to macOS users. The campaigns bypass traditional security measures by tricking users into manually executing malicious commands rather than exploiting software vulnerabilities.
ClickFix attacks present fake error messages or system prompts that instruct users to copy and paste terminal commands. These commands appear legitimate but actually download and install the MacSync stealer on the victim's Mac.
macOS Users Targeted Across Multiple Campaigns
All macOS versions are potentially vulnerable since the attack doesn't exploit system flaws but relies on user actions. Mac users who encounter suspicious pop-ups, fake error messages, or prompts requesting terminal command execution face the highest risk.
The three campaigns target different user segments through varied social engineering approaches, making the threat widespread across the macOS user base.
Related: AI-Generated Slopoly Malware Powers Interlock Ransomware
Related: Zombie ZIP: How Malformed Archives Let Malware Slip Past
Related: BeatBanker Android Banking Malware 2026: Fake Starlink App
Related: Malicious npm Package Mimics OpenClaw AI to Deploy RAT
Related: ClickFix Campaign Exploits Windows Terminal for Lumma
MacSync Stealer Harvests Sensitive Information
Once installed, MacSync operates as an information stealer, collecting sensitive data from infected Mac systems. The malware focuses on harvesting credentials, browser data, and other valuable information stored on compromised devices.
Users should avoid copying and executing any commands from pop-ups or suspicious websites. CISA recommends maintaining updated security awareness and verifying any system prompts through official channels before taking action.
