Kaspersky Uncovers New MacSync Malware Targeting macOS Users

• •New MacSync malware targets macOS users, stealing credentials and crypto assets.
• •The malware uses a complex infection chain, beginning with a malicious file download.
• •Kaspersky advises users to verify application sources and protect their administrator passwords.

Kaspersky has identified an updated version of MacSync malware, which targets macOS users to steal credentials and cryptocurrency assets. This sophisticated infostealer, first detected in 2024-2025 as a variant of the AMOS stealer, employs a complex infection chain. The attack begins with users downloading a malicious file disguised as a legitimate application, which then triggers additional malicious downloads. The malware installs two main components: an infostealer and a backdoor, with the latter disguised as the Finder application. Once operational, the infostealer collects sensitive data, including browser histories, saved credentials, and information from cryptocurrency wallets. Kaspersky warns users to verify application legitimacy and treat administrator passwords with caution. The latest version was detected in September 2026, and Kaspersky plans to release more information on Securelist.com soon.