#macsync — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #macsync, aggregated by home.social.
-
ISC Diary: Malicious ad for Homebrew leads to #MacSync #Stealer https://isc.sans.edu/diary/32942
-
ISC Diary: Malicious ad for Homebrew leads to #MacSync #Stealer https://isc.sans.edu/diary/32942
-
ISC Diary: Malicious ad for Homebrew leads to #MacSync #Stealer https://isc.sans.edu/diary/32942
-
ISC Diary: Malicious ad for Homebrew leads to #MacSync #Stealer https://isc.sans.edu/diary/32942
-
ISC Diary: Malicious ad for Homebrew leads to #MacSync #Stealer https://isc.sans.edu/diary/32942
-
📢⚠️ Hackers are abusing hijacked Google Ads and fake Claude AI guides in a new #ClickFix attack targeting Mac users. Victims are tricked into pasting malicious Terminal commands that install #MacSync infostealer malware.
Read more: https://hackread.com/google-ads-claude-ai-macsync-malware-clickfix/
-
📢⚠️ Hackers are abusing hijacked Google Ads and fake Claude AI guides in a new #ClickFix attack targeting Mac users. Victims are tricked into pasting malicious Terminal commands that install #MacSync infostealer malware.
Read more: https://hackread.com/google-ads-claude-ai-macsync-malware-clickfix/
-
📢⚠️ Hackers are abusing hijacked Google Ads and fake Claude AI guides in a new #ClickFix attack targeting Mac users. Victims are tricked into pasting malicious Terminal commands that install #MacSync infostealer malware.
Read more: https://hackread.com/google-ads-claude-ai-macsync-malware-clickfix/
-
📢⚠️ Hackers are abusing hijacked Google Ads and fake Claude AI guides in a new #ClickFix attack targeting Mac users. Victims are tricked into pasting malicious Terminal commands that install #MacSync infostealer malware.
Read more: https://hackread.com/google-ads-claude-ai-macsync-malware-clickfix/
-
📢⚠️ Hackers are abusing hijacked Google Ads and fake Claude AI guides in a new #ClickFix attack targeting Mac users. Victims are tricked into pasting malicious Terminal commands that install #MacSync infostealer malware.
Read more: https://hackread.com/google-ads-claude-ai-macsync-malware-clickfix/
-
2025-12-23 (Tuesday): Based on yesterday's Jamf article, I downloaded the fake installer for #MacSyncStealer from zkcall[.]net and ran it on a macOS host in my lab.
A #pcap of the #MacSync #Stealer traffic, the associated IOCs, the #malware sample, and a link to the Jamf article are at www.malware-traffic-analysis.net/2025/12/23/index.html
Of note, the zkcall[.]net download page also has a link for a Windows download. The downloaded EXE file appears to be #DonutLoader, based on one of the follow-up EXE files it retrieved and ran: https://app.any.run/tasks/afd3ae74-2976-492b-a3c0-6e19e9127f68
-
2025-12-23 (Tuesday): Based on yesterday's Jamf article, I downloaded the fake installer for #MacSyncStealer from zkcall[.]net and ran it on a macOS host in my lab.
A #pcap of the #MacSync #Stealer traffic, the associated IOCs, the #malware sample, and a link to the Jamf article are at www.malware-traffic-analysis.net/2025/12/23/index.html
Of note, the zkcall[.]net download page also has a link for a Windows download. The downloaded EXE file appears to be #DonutLoader, based on one of the follow-up EXE files it retrieved and ran: https://app.any.run/tasks/afd3ae74-2976-492b-a3c0-6e19e9127f68
-
2025-12-23 (Tuesday): Based on yesterday's Jamf article, I downloaded the fake installer for #MacSyncStealer from zkcall[.]net and ran it on a macOS host in my lab.
A #pcap of the #MacSync #Stealer traffic, the associated IOCs, the #malware sample, and a link to the Jamf article are at www.malware-traffic-analysis.net/2025/12/23/index.html
Of note, the zkcall[.]net download page also has a link for a Windows download. The downloaded EXE file appears to be #DonutLoader, based on one of the follow-up EXE files it retrieved and ran: https://app.any.run/tasks/afd3ae74-2976-492b-a3c0-6e19e9127f68
-
2025-12-23 (Tuesday): Based on yesterday's Jamf article, I downloaded the fake installer for #MacSyncStealer from zkcall[.]net and ran it on a macOS host in my lab.
A #pcap of the #MacSync #Stealer traffic, the associated IOCs, the #malware sample, and a link to the Jamf article are at www.malware-traffic-analysis.net/2025/12/23/index.html
Of note, the zkcall[.]net download page also has a link for a Windows download. The downloaded EXE file appears to be #DonutLoader, based on one of the follow-up EXE files it retrieved and ran: https://app.any.run/tasks/afd3ae74-2976-492b-a3c0-6e19e9127f68
-
2025-12-23 (Tuesday): Based on yesterday's Jamf article, I downloaded the fake installer for #MacSyncStealer from zkcall[.]net and ran it on a macOS host in my lab.
A #pcap of the #MacSync #Stealer traffic, the associated IOCs, the #malware sample, and a link to the Jamf article are at www.malware-traffic-analysis.net/2025/12/23/index.html
Of note, the zkcall[.]net download page also has a link for a Windows download. The downloaded EXE file appears to be #DonutLoader, based on one of the follow-up EXE files it retrieved and ran: https://app.any.run/tasks/afd3ae74-2976-492b-a3c0-6e19e9127f68