Microsoft reports MacSync Stealer infections that start when a user is tricked into pasting or running commands in macOS Terminal (a “ClickFix” style lure). Those commands use built-in tools like curl to download and run the payload, then the stealer collects credentials and sensitive files, stages them in /tmp, and uploads them in chunks to attacker-controlled websites that rotate domains quickly.
MacSync Stealer infections begin with a ClickFix style lure. A user encounters fake troubleshooting steps, often through a website or chat agent, that instruct them to open Terminal and paste a command to fix an issue. Once entered, that command uses curl to pull down attacker-controlled payload content, which is then decoded and unpacked using native macOS utilities like Base64 and gunzip. From there, the stealer runs and begins collecting data.
The malware targets high-value information: macOS Keychain items, browser data, SSH keys, cloud credentials, and other sensitive files. Collected data is staged under temporary paths such as /tmp/sync*, compressed into an archive like /tmp/osalogging.zip, split into chunks, and exfiltrated via HTTP PUT uploads to attacker-controlled sites. Those sites rotate domains quickly, which complicates blocking based on static indicators alone.
The attack relies on trust in a familiar troubleshooting pattern rather than a sophisticated exploit. Employees are conditioned to follow on-screen fix-it instructions, especially when they appear to come from support or a chat agent, and pasting a single command into Terminal feels routine rather than risky. Because the payload is retrieved and executed using built-in tools like curl, Base64, and gunzip, the activity can blend in with normal administrative or troubleshooting behavior rather than triggering obvious alarms.
Defenders should treat any instruction to paste or run Terminal commands as a major red flag and train users to verify such requests through official IT channels first, rather than following instructions from an unverified website, chat, app, file, or phone call. Because rotating infrastructure weakens static domain blocking and retrospective indicator matching, detection efforts should focus on durable behavioral patterns: sequences of native tool abuse, staging of data in temporary paths, compression into archives, and chunked uploads via HTTP PUT. Awareness training should reinforce that even legitimate, built-in tools like curl can be repurposed for malicious downloads and data theft, so unusual use of trusted utilities deserves scrutiny regardless of how routine the request seems.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is a lure where a user is tricked into pasting or running commands in Terminal, often under the guise of fixing an issue, which then downloads and runs malware.
Execution starts from an interactive shell session where the user pastes a provided command, which uses curl to retrieve attacker-controlled payload content followed by script-driven execution.
It collects high-value data including macOS Keychain items, browser data, SSH keys, cloud credentials, and other sensitive files.
Collected data is staged under temporary paths, compressed into an archive, split into chunks, and uploaded through HTTP PUT requests, and attackers rotate domains quickly to evade static blocking.
You’re in an online chat, and support says, “To fix this quickly, open Terminal, paste this command, then press Enter.” That’s the Mac ClickFix trick. You copy one Terminal command, it runs curl, silently pulls a MacSync Stealer script, unpacks it, and starts digging through your Keychain, browser logins, SSH keys, and cloud creds. Behind the scenes it stuffs your data into /tmp folders like sync1234, compresses it into osalogging.zip, then slices it up and sends chunks via HTTP PUT to random-looking domains that keep changing, but the same curl and upload pattern repeats. If anyone tells you to paste a Terminal command to ‘fix’ something, stop. Don’t run it, send a screenshot to IT and ask them first.
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
A real ClickFix campaign used 250+ lookalike domains and browser fingerprinting to show malware lures mainly to real macOS visitors while showing harmless decoys to scanners and researchers. Victims were pushed to copy and run an obfuscated command in macOS Terminal, which then downloaded and…
Microsoft observed real-world campaigns where victims were tricked by “ClickFix” prompts into pasting a command into Windows Run, which then installed ACR (Amatera) Stealer. The malware steals saved browser passwords, live session tokens, and Microsoft 365/OneDrive/SharePoint files, meaning…
Researchers say a real macOS malware campaign is using “ClickFix” social engineering to trick users into installing an infostealer called AmnesiaStealer. Victims are lured to a counterfeit GitHub download page that encourages them to copy/paste a Terminal command, which then downloads and runs the…
Researchers found real GitHub repositories containing poisoned AI-agent instruction/config files (like CLAUDE.md and .cursorrules) that silently tell coding assistants to steal prompts, environment variables, and credentials. The malicious instructions can trigger hidden commands (for example, curl…
Researchers found a real macOS malware campaign that uses a fake GitHub download page to convince users to paste a command into Terminal and enter their Mac password. The malware then steals credentials, cookies, and files, and can even turn the victim’s Chromium browser into a remotely controlled…
