A live OTX pulse authored by AlienVault documents an active macOS stealer campaign attributed to the MacSync malware family, distributed through ClickFix-style social engineering. The campaign abuses fake CAPTCHA verification pages — delivered via links in phishing emails — that instruct victims to copy and execute a malicious command directly in macOS Terminal. That single paste-execution action kicks off the entire kill chain: a profiling script fingerprints the host, collects system information, and then retrieves an architecture-specific (Intel/Apple Silicon) Go-compiled Mach-O binary from attacker infrastructure.

The objective is financially motivated theft at scale: browser-stored passwords, cryptocurrency wallet credentials, and wallet files are exfiltrated, effectively draining victim wallets. The pulse tags reference aeza group — a hosting provider frequently abused by threat actors for bulletproof staging and C2 — which aligns with the raw-IP delivery URL (193.29.224.151) observed in the indicator set. Although the pulse carries no formal MITRE ATT&CK mapping, the tradecraft maps cleanly to T1204 (User Execution), T1059.004 (Unix Shell), T1555 (Credentials from Password Stores), and T1218-style system discovery. The description truncation ("targets browser passwords, Appl...") strongly suggests Apple-native credential stores — Safari keychain and possibly Apple Notes / Apple ID tokens — are in scope. TLP:WHITE classification means defenders can freely share these indicators and detections.

Threat Actor / Malware Profile

Attribution: Unknown threat actor. Infrastructure patterns (aeza group hosting, raw-IP payload delivery, disposable domain profitnow.io) indicate a financially motivated crimeware operator rather than a state-sponsored APT, despite the pulse being filed under APT & Nation-State category feeds.

Distribution method: Phishing emails link to fake CAPTCHA pages. The page displays ClickFix-style instructions claiming the user must run a verification command, coercing the victim into pasting a shell one-liner into Terminal.app. This technique completely bypasses email sandboxing, Gatekeeper, and signature-based AV because the user is the execution engine — no malicious file ever transits the mail gateway.

Payload behavior: The initial command downloads and executes a profiling script that gathers OS version, CPU architecture, and system metadata. Based on the profile, a second-stage Go-based Mach-O payload (x86_64 or arm64) is fetched and executed. The four SHA-256 hashes in the pulse represent distinct payloads — consistent with architecture-specific builds and/or versioning across the campaign.

C2 communication: Outbound HTTP to raw IPs (193.29.224.151) with query-string beaconing patterns ("?force=1" style parameters), and resolution/contact with the operational domain profitnow.io. Go-compiled stealers typically exfiltrate via HTTP POST or embedded Telegram/Discord API channels — SOC teams should alert on any of the listed indicators plus anomalous outbound traffic from curl, osascript, or unsigned Mach-O binaries.

Persistence mechanism: Not explicitly detailed in the pulse, but macOS stealers of this class commonly establish LaunchAgents/LaunchDaemons (~/Library/LaunchAgents) or append to shell profiles (.zshrc) for re-execution. Hunt accordingly.

Anti-analysis techniques: Go compilation (large, noisy binaries that frustrate static analysis and signature engines), architecture-conditional payload delivery (evades sandboxes that only emulate one architecture), user-driven execution (evades perimeter controls entirely), and IP-based staging infrastructure that survives domain takedowns.

IOC Analysis

The pulse contains 8 indicators across three operational types:

• File hashes (6): 1 MD5, 1 SHA-1, and 4 SHA-256 values identifying the Go Mach-O payloads. Hash-based blocking is fragile against recompilation but essential for retro-hunting: sweep EDR telemetry for any historical execution of these hashes. Load all six into your EDR blocklist and VirusTotal Enterprise / MISP watchlists.
• URL (1): http://193.29.224.151/92392991a0cca55?force=1 — the second-stage payload delivery URL. The randomized path with a "force" parameter is a classic stealer staging pattern. Block at the proxy/secure web gateway and hunt for any host that contacted this IP on any port.
• Domain (1): profitnow.io — operational infrastructure. Sinkhole or block at DNS; hunt passive DNS and resolver logs for historical lookups.

Tooling guidance: Feed hashes into CrowdStrike/SentinelOne/Defender custom IOC lists; add the IP and domain to firewall egress deny rules and DNS RPZ. Use shasum -a 256 locally to verify suspect files, and codesign -dv / spctl --assess to check signing status of any Mach-O found in user Downloads or /tmp. Fleet-wide hunting is best done with osquery, Jamf Protect, or your EDR's file/hash query capability.

Detection Engineering

The following Sigma rules target the campaign's core behaviors: ClickFix Terminal execution chains, suspicious curl/osascript download-and-execute activity, and network contact with the documented C2 infrastructure.

---
title: ClickFix Terminal Execution Chain - MacSync Stealer
description: Detects suspicious Terminal/shell process chains indicative of ClickFix fake CAPTCHA social engineering delivering MacSync stealer payloads on macOS
date: 2026/09/05
author: Security Arsenal Threat Intel
logsource:
    category: process_creation
    product: macos
    os: darwin
detection:
    selection_parent:
        ParentImage|endswith:
            - '/Terminal'
            - '/iTerm2'
            - '/zsh'
            - '/bash'
    selection_child:
        Image|endswith:
            - '/curl'
            - '/wget'
            - '/osascript'
    selection_args:
        CommandLine|contains:
            - '| zsh'
            - '| bash'
            - '| sh'
            - 'base64 -D'
            - 'chmod +x'
    condition: selection_parent and selection_child and selection_args
falsepositives:
    - Legitimate developer or admin installation scripts run manually from Terminal
level: high
tags:
    - attack.execution
    - attack.t1204
    - attack.t1059.004
---
title: MacSync Stealer C2 Infrastructure Contact
description: Detects network connections to known MacSync stealer staging and C2 infrastructure documented in OTX pulse
date: 2026/09/05
author: Security Arsenal Threat Intel
logsource:
    category: network_connection
detection:
    selection_ip:
        DestinationIp: '193.29.224.151'
    selection_domain:
        DestinationHostname: 'profitnow.io'
    condition: 1 of selection_*
falsepositives:
    - Threat intelligence researchers validating indicators
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001
---
title: Suspicious Mach-O Execution From User Writable Paths
description: Detects execution of unsigned binaries from temporary or user-writable directories consistent with MacSync Go payload staging
date: 2026/09/05
author: Security Arsenal Threat Intel
logsource:
    category: process_creation
    product: macos
    os: darwin
detection:
    selection_path:
        Image|startswith:
            - '/tmp/'
            - '/var/tmp/'
            - '/Users/'
    selection_location:
        Image|contains:
            - '/Downloads/'
            - '/.tmp'
            - 'TMPDIR'
    selection_profile:
        CommandLine|contains:
            - 'system_profiler'
            - 'sw_vers'
            - 'sysctl hw'
    condition: selection_path and (selection_location or selection_profile)
falsepositives:
    - User-installed unsigned open source utilities
    - Developer build artifacts
level: medium
tags:
    - attack.execution
    - attack.discovery
    - attack.t1082

// MacSync ClickFix campaign hunt - Microsoft Sentinel / Defender
// Hunts for curl/wget download-execute chains and known C2 indicators
let lookback = 14d;
let bad_ip = "193.29.224.151";
let bad_domain = "profitnow.io";
let macsync_hashes = dynamic(["5bad988affc1094f12b8b8bed659ef55b20e2988eb25441e1c1b34dd03b3eb52",
    "619a99ba4ee9d7f33db8045c7e03c4265424977993fe8a53b0f45157c5abd3e5",
    "b43a909a01e954d6549558f2f7e9bb58e34959a0ae229f340d61091ab726bbd3",
    "f0062f7e70e61493684a2f60748a475168e155bc2502163c844c42e87692abd0"]);
let NetworkHits = DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where RemoteIP == bad_ip or RemoteUrl contains bad_domain or RemoteUrl contains "92392991a0cca55"
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, ActionType;
let ClickFixChains = DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where InitiatingProcessFileName has_any ("Terminal", "iTerm2", "zsh", "bash")
    | where FileName in~ ("curl", "wget", "osascript")
    | where ProcessCommandLine has_any ("| sh", "| bash", "| zsh", "base64 -D", "chmod +x", "force=1")
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256;
let HashHits = DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where SHA256 in~ (macsync_hashes)
    | project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, SHA256, ProcessCommandLine;
union NetworkHits, ClickFixChains, HashHits
| sort by TimeGenerated desc

#!/bin/bash
# MacSync Stealer IOC & Artifact Hunt - macOS fleet triage script
# Run with sudo on suspect endpoints or via MDM/remote shell

echo "=== MacSync IOC Hunt - $(hostname) - $(date) ==="

echo "[+] Checking for known malicious file hashes..."
HASHES="5bad988affc1094f12b8b8bed659ef55b20e2988eb25441e1c1b34dd03b3eb52 619a99ba4ee9d7f33db8045c7e03c4265424977993fe8a53b0f45157c5abd3e5 b43a909a01e954d6549558f2f7e9bb58e34959a0ae229f340d61091ab726bbd3 f0062f7e70e61493684a2f60748a475168e155bc2502163c844c42e87692abd0"
for dir in /tmp /var/tmp /Users/*/Downloads /Users/*/Library; do
  if [ -d "$dir" ]; then
    find "$dir" -type f -perm +111 2>/dev/null | while read -r f; do
      h=$(shasum -a 256 "$f" 2>/dev/null | awk '{print $1}')
      for bad in $HASHES; do
        if [ "$h" == "$bad" ]; then echo "[!] MALICIOUS FILE: $f (SHA256: $h)"; fi
      done
    done
  fi
done

echo "[+] Checking shell history for ClickFix-style paste-executed commands..."
for user_home in /Users/*; do
  for hist in "$user_home/.zsh_history" "$user_home/.bash_history"; do
    if [ -f "$hist" ]; then
      grep -nE "curl.*\|(sh|bash|zsh)|force=1|193\.29\.224\.151|profitnow\.io|base64 -D" "$hist" 2>/dev/null && echo "[!] Suspicious history in $hist"
    fi
  done
done

echo "[+] Checking LaunchAgents/LaunchDaemons for persistence..."
ls -la /Users/*/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons 2>/dev/null | grep -iE "sync|update|helper|agent" 
grep -lE "193\.29\.224\.151|profitnow\.io|force=1" /Users/*/Library/LaunchAgents/*.plist /Library/LaunchAgents/*.plist /Library/LaunchDaemons/*.plist 2>/dev/null

echo "[+] Checking active and logged network connections to C2..."
netstat -an 2>/dev/null | grep "193.29.224.151"
log show --last 24h --predicate 'process == "curl" OR eventMessage CONTAINS "profitnow.io"' 2>/dev/null | grep -iE "profitnow|193\.29\.224" | head -20

echo "[+] Checking DNS resolver cache for profitnow.io..."
dscacheutil -cachedump -entries host 2>/dev/null | grep -i profitnow

echo "=== Hunt complete. Review any [!] findings immediately. ==="

Response Priorities

Immediate (0-4h):

• Block 193.29.224.151 and profitnow.io at DNS (RPZ/sinkhole), secure web gateway, and firewall egress. Block the delivery URL pattern at the proxy.
• Push all six file hashes into EDR custom blocklists and retro-hunt 30 days of execution telemetry for hash matches.
• Alert on any endpoint where Terminal/iTerm spawned curl or wget piping to a shell — treat as probable compromise pending triage.
• Identify users who received phishing emails containing CAPTCHA-verification lures via email gateway logs.

24 hours:

• MacSync is credential-stealing malware: any confirmed or suspected execution requires immediate identity response — force password resets for all accounts whose credentials were stored in the victim's browsers, revoke active sessions and OAuth tokens, and rotate any cryptocurrency wallet keys/seed phrases that were accessible on the host.
• Assume Apple ID, keychain, and saved browser credentials on affected machines are compromised; check identity provider logs for anomalous logins from those accounts.
• Capture memory/disk images of affected hosts before remediation; preserve shell history files as evidence.

1 week:

• Deploy Apple Lockdown Mode considerations for high-risk users; enforce Gatekeeper and notarization enforcement; restrict unsigned Mach-O execution via MDM where feasible.
• Roll out detections above fleet-wide; add osquery or Jamf Protect policies alerting on LaunchAgent creation in user libraries.
• Conduct targeted user awareness training on ClickFix lures: legitimate CAPTCHAs never require Terminal commands — this single message defeats the entire delivery mechanism.
• Move cryptocurrency-holding employees to hardware wallets and prohibit wallet software/seed phrases on corporate endpoints via policy.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub