Kaspersky reports a real-world MacSync infostealer campaign seen in September 2026 that tricks users into installing fake or cracked macOS apps. The attack uses staged downloads (including iCloud Calendar content) and then prompts the user for an administrator password using realistic-looking pop-ups that mimic the impersonated app and a macOS warning.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: a shiny new crypto wallet called “Toria” pops up on X and Telegram, promising a free macOS app. You download the Toria DMG, open it, and the “wallet” instantly asks for your Mac administrator password, then shows a fake macOS alert saying the app is corrupted and can be moved to the trash. That’s MacSync infostealer doing its job. Behind that, MacSync is a malware‑as‑a‑service infostealer. It came from a malicious DMG, pulls extra commands from things like an iCloud Calendar file, and then digs in using LaunchAgents and edits to files like .zshrc and Git hooks. If any new Mac app, especially a “free” or social‑media‑only one, immediately asks for your admin password or says it’s corrupted, stop. Close it and report it to IT Security right away.
A Japanese industrial manufacturer was targeted by the SilverFox group using an invoice-themed phishing email that kicked off a multi-stage malware chain. The campaign abused legitimate software and cloud services to load a malicious DLL, disable security tools, and establish remote access with…
Researchers say the Iran-linked group Nimbus Manticore posed as recruiters on LinkedIn and job platforms to send developers “technical challenge” ZIP files that secretly installed cross-platform remote access trojans. The lures used urgency (short test windows) and realistic developer workflows…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
Attackers impersonated LastPass on GitHub and tricked people searching for the “LastPass Authenticator download” into installing a fake installer. The infection chain used a Microsoft-signed driver to disable many security tools, then deployed an infostealer that stole passwords, crypto wallets,…
Researchers describe real-world “ClickFix” social-engineering lures that trick people into installing malware by downloading fake apps (like Spotify/Zoom/Teams) or copying commands into Terminal. One campaign abused a compromised, verified HBO Max Reddit account to run malicious ads, while another…
Unit 42 showed that default AWS AgentCore Harness settings can let an attacker use prompt injection to trick an AI agent into running shell commands and exposing plaintext credentials from AgentCore Identity at runtime. In their demo, a malicious support ticket embedded instructions (via hidden…
