MacSync Stealer + ClickFix Fake CAPTCHA Campaign: OTX Pulse Analysis — macOS Credential & Crypto Wallet Detection Pack

A single AlienVault OTX pulse published 2026-09-05 documents an active macOS infostealer campaign distributing the MacSync stealer through the ClickFix social-engineering technique. Victims receive email links leading to a fake CAPTCHA verification page. Instead of clicking images, the page instructs the user to copy and paste a malicious command into macOS Terminal — a delivery mechanism that bypasses email gateway sandboxing, Gatekeeper quarantine enforcement (the user manually executes the code), and most legacy AV signatures because no malicious attachment is ever delivered.

Once executed, the command retrieves a profiling script that fingerprints the host (architecture, OS version, username) and downloads an architecture-specific Go-based Mach-O payload. MacSync then harvests browser-stored passwords, Apple Keychain data, and — critically — cryptocurrency wallet artifacts, exfiltrating the bundle to operator infrastructure. Tags on the pulse reference Aeza Group, a bulletproof hosting provider repeatedly abused for malware staging and C2, consistent with the hardcoded IP indicator in this campaign.

This is a commodity-grade but operationally effective campaign: low cost of entry, high-value target set (crypto holders on macOS, historically under-instrumented in enterprise environments), and a delivery vector that defeats perimeter-only defenses. Organizations with BYOD macOS fleets, executives holding crypto assets, or developers with wallet software installed should treat this as high priority.

Threat Actor / Malware Profile

Adversary attribution: Unknown. Infrastructure overlap with Aeza Group hosting suggests financially motivated operators purchasing bulletproof hosting rather than a state-sponsored intrusion set.

Malware: MacSync Stealer

• Distribution method: ClickFix social engineering — email-delivered links redirect to fake CAPTCHA pages that present a pre-populated malicious shell command and instruct victims to paste it into Terminal (frequently leveraging curl | zsh or osascript patterns). This is a variant of the technique popularized by AMOS (Atomic Stealer) campaigns in 2024–2025.
• Payload behavior: A Go-compiled Mach-O binary, delivered in architecture-specific builds (x86_64 / arm64) selected by the profiling script. Go cross-compilation gives the operator a single codebase with minimal dependency footprint on the victim host.
• Collection targets: Browser credential stores (Chrome, Brave, Edge, Firefox keychains), Apple Keychain items, cookies/session tokens, and cryptocurrency wallet data (browser-extension wallets and desktop wallet files such as Electrum, Exodus, Ledger Live configuration).
• C2 communication: HTTP GET to a raw IP endpoint — 193.29.224.151 — with a query-string parameter (?force=1) suggesting payload staging with forced-refresh semantics. Supporting domain profitnow.io likely serves as lure/distribution or fallback C2. Raw-IP C2 with a path-only URI is consistent with low-cost bulletproof-hosted panels.
• Persistence mechanism: Not explicitly documented in the pulse, but MacSync-class stealers typically install a LaunchAgent (~/Library/LaunchAgents/*.plist) or append to shell profile files for re-execution. Hunters should validate both.
• Anti-analysis techniques: User-driven execution defeats sandbox detonation (no automated Terminal paste). Profiling script filters execution to real macOS hardware. Go binaries resist string-based signature matching and inflate analysis time; architecture-specific payloads reduce the chance researchers grab the wrong build.

MITRE ATT&CK mapping (inferred):

IOC Analysis

The pulse contains 8 indicators across three types, and each requires a distinct operationalization path:

File hashes (6): One MD5, one SHA1, four SHA256 covering the Mach-O payloads and likely the profiling script. Hash-based detection is necessary but fragile for this campaign — the architecture-specific payload generation means hash rotation is cheap. Import all six into your EDR blocklist and retro-hunt across any macOS fleet telemetry (MDM, Jamf, Defender for Endpoint on Mac, CrowdStrike).

URL (1): http://193.29.224.151/92392991a0cca55?force=1 — the staging/C2 endpoint. Block at the web proxy and DNS sinkhole layers, but note that raw-IP HTTP traffic from macOS endpoints is itself a high-signal behavioral detection: legitimate macOS software rarely communicates with bare IPs over plaintext HTTP.

Domain (1): profitnow.io — sinkhole immediately and pivot on DNS resolution history. Any endpoint resolving this domain should be treated as potentially compromised even if no hash match exists, since the domain may host the lure page (pre-infection) rather than the payload.

Tooling guidance: Enrich the IP against Aeza Group netblocks in your TI platform (AlienVault OTX, MISP, Recorded Future). Use jtool2, otool -L, and codesign -dvvv on any recovered Mach-O for static triage; Objective-See's KnockKnock and BlockBlock surface persistence on live macOS hosts. Sandbox detonation must be user-interaction-aware — standard auto-run detonation will miss ClickFix staging.

Detection Engineering

---
title: MacSync ClickFix Fake CAPTCHA Terminal Execution
id: 3f7a1c2e-8b4d-4e6a-9c1f-2d5e7a9b0c12
status: experimental
description: Detects ClickFix-style social engineering where a user is tricked into pasting a curl/wget command into macOS Terminal to download and execute a payload, as seen in the MacSync stealer campaign.
author: Security Arsenal Threat Intel
date: 2026/09/05
references:
    - https://www.huntress.com/blog/mac-crypto-draining-malware
logsource:
    product: macos
    category: process_creation
detection:
    selection_parent:
        ParentImage|endswith:
            - '/Terminal'
            - '/iTerm2'
            - '/loginwindow'
    selection_child:
        Image|endswith:
            - '/curl'
            - '/wget'
            - '/zsh'
            - '/bash'
            - '/osascript'
    selection_cmd:
        CommandLine|contains:
            - 'curl'
            - '| sh'
            - '| zsh'
            - '| bash'
            - 'chmod +x'
            - 'force=1'
    condition: selection_parent and selection_child and selection_cmd
falsepositives:
    - Developer workflows using curl-pipe-shell installers (Homebrew, rustup)
level: high
tags:
    - attack.t1204.002
    - attack.t1059.004
---
title: MacSync Stealer C2 Communication to Raw IP Endpoint
id: 8a2d4f6b-1c3e-5a7b-8d9f-0e1c3a5b7d9f
status: experimental
description: Detects outbound HTTP communication from macOS endpoints to the MacSync staging/C2 IP 193.29.224.151 (Aeza Group hosting) or the associated lure domain profitnow.io.
author: Security Arsenal Threat Intel
date: 2026/09/05
references:
    - https://otx.alienvault.com
logsource:
    category: network_connection
detection:
    selection_ip:
        DestinationIp:
            - '193.29.224.151'
    selection_domain:
        DestinationHostname|contains:
            - 'profitnow.io'
    selection_uri:
        Image|endswith:
            - '/curl'
            - '/wget'
        CommandLine|contains:
            - '92392991a0cca55'
    condition: selection_ip or selection_domain or selection_uri
falsepositives:
    - Unlikely; raw-IP HTTP staging is rare in legitimate macOS software
level: critical
tags:
    - attack.t1071.001
---
title: Suspicious Mach-O Execution from User-Writable Directories
id: 5b8e0a2d-4f6c-7a9b-1d3e-5f7a9b1d3e5f
status: experimental
description: Detects execution of unsigned or user-dropped Mach-O binaries (including Go-compiled stealers like MacSync) from user-writable paths such as /tmp, ~/Downloads, or ~/Library on macOS.
author: Security Arsenal Threat Intel
date: 2026/09/05
logsource:
    product: macos
    category: process_creation
detection:
    selection_path:
        Image|startswith:
            - '/tmp/'
            - '/var/tmp/'
            - '/Users/*/Downloads/'
            - '/Users/*/Library/'
    selection_not_signed:
        Signed: 'false'
    filter_known:
        Image|contains:
            - '/Xcode/'
            - '/DerivedData/'
            - '/node_modules/'
    condition: selection_path and selection_not_signed and not filter_known
falsepositives:
    - Local developer builds; Homebrew ad-hoc binaries
level: medium
tags:
    - attack.t1059
    - attack.t1204

// MacSync Stealer — macOS ClickFix hunt (Microsoft Defender for Endpoint / Sentinel)
// Part 1: Terminal-spawned downloaders matching ClickFix behavior
let ClickFixProcs = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("Terminal", "iTerm2")
   or FileName in~ ("curl", "wget", "osascript", "zsh", "bash")
| where ProcessCommandLine has_any ("curl", "wget", "| sh", "| zsh", "| bash", "force=1", "chmod +x")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256;
// Part 2: Network connections to MacSync C2 / lure infrastructure
let C2Events = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteIP == "193.29.224.151"
   or RemoteUrl contains "profitnow.io"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort;
union ClickFixProcs, C2Events
| sort by TimeGenerated desc
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), EventCount=count() by DeviceName, FileName, ProcessCommandLine, RemoteIP
| where EventCount > 0

#!/bin/bash
# macsync_hunt.sh — MacSync Stealer IOC & artifact hunt for macOS endpoints
# Run via MDM (Jamf/Intune) or manually with sudo. Read-only; no remediation performed.

echo "=== MacSync Stealer Hunt — $(date) ==="

echo -e "\n[1] Hash check — known MacSync payloads"
KNOWN_HASHES=(
  "5bad988affc1094f12b8b8bed659ef55b20e2988eb25441e1c1b34dd03b3eb52"
  "619a99ba4ee9d7f33db8045c7e03c4265424977993fe8a53b0f45157c5abd3e5"
  "b43a909a01e954d6549558f2f7e9bb58e34959a0ae229f340d61091ab726bbd3"
  "f0062f7e70e61493684a2f60748a475168e155bc2502163c844c42e87692abd0"
)
for dir in /tmp /var/tmp /Users/*/Downloads /Users/*/Library; do
  find "$dir" -type f -perm +111 2>/dev/null | while read -r f; do
    h=$(shasum -a 256 "$f" 2>/dev/null | awk '{print $1}')
    for kh in "${KNOWN_HASHES[@]}"; do
      [ "$h" == "$kh" ] && echo "  [HIT] $f matches known MacSync hash $h"
    done
  done
done

echo -e "\n[2] LaunchAgent / LaunchDaemon persistence check"
for p in /Library/LaunchAgents /Library/LaunchDaemons /Users/*/Library/LaunchAgents; do
  ls -la "$p" 2>/dev/null | grep -vE "com.apple|com.google|com.microsoft" | head -20
done

echo -e "\n[3] Shell profile tampering (ClickFix re-execution hooks)"
for u in /Users/*; do
  for rc in .zshrc .bash_profile .bashrc .zprofile; do
    grep -lE "curl|wget|193\.29\.224\.151|profitnow" "$u/$rc" 2>/dev/null && echo "  [HIT] suspicious content in $u/$rc"
  done
done

echo -e "\n[4] DNS cache / log check for profitnow.io"
log show --last 14d --predicate 'process == "mDNSResponder"' 2>/dev/null | grep -i "profitnow" | head -10

echo -e "\n[5] Network connections to C2 IP 193.29.224.151"
lsof -i 2>/dev/null | grep "193.29.224.151" || echo "  No live connections to C2"
netstat -an 2>/dev/null | grep "193.29.224.151"

echo -e "\n[6] Recent unsigned Mach-O execution artifacts (quarantine-free drops)"
find /Users/*/Downloads /tmp -name "*.command" -o -name "*.sh" -mtime -14 2>/dev/null | head -20

echo -e "\n=== Hunt complete. Escalate any [HIT] lines to IR immediately. ==="

Response Priorities

Immediate (0–4 hours):

• Block 193.29.224.151 at the egress firewall and web proxy; sinkhole profitnow.io at the DNS layer.
• Push all six file hashes to EDR blocklists and trigger retro-hunts across the full macOS fleet, including BYOD devices enrolled in MDM.
• Search email gateway logs for links to profitnow.io or ClickFix-style lures (subjects referencing CAPTCHA verification, account re-validation, or wallet security alerts).
• Deploy the KQL hunt and bash script above to all macOS endpoints; prioritize executive and developer populations.

Within 24 hours:

• For any endpoint with a confirmed hash match or C2 connection: assume full credential compromise. Force password resets for all accounts accessible from the device, revoke active sessions and OAuth tokens, and rotate any API keys or SSH keys stored locally.
• Treat browser session cookies as burned — MacSync harvests session tokens that bypass MFA. Invalidate IdP sessions (Okta/Entra) for affected users.
• If cryptocurrency wallets (desktop or browser-extension) were present on the device, advise the user to transfer assets to a newly generated wallet on a clean device; assume seed phrases stored on the host are exposed.
• Pull Keychain access logs and browser credential export artifacts to scope what was exfiltrated.

Within 1 week:

• Enforce Apple Endpoint Security framework telemetry collection (via EDR) on all macOS assets — this campaign specifically exploits the enterprise macOS visibility gap.
• Implement Gatekeeper/Notarization enforcement policies and restrict unsigned Mach-O execution via MDM configuration profiles.
• Deploy user-awareness content specifically covering ClickFix: the single most effective control is training users that no legitimate CAPTCHA ever requires pasting commands into Terminal.
• Review BYOD policy for crypto-asset custody — consider requiring hardware wallets and prohibiting seed-phrase storage on managed endpoints.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub