MacSync Stealer Malware — Analysis, Campaigns & Threat Activity

Threat entity extracted from intelligence sources

Frequency
16
occurrences
First Seen
November 12, 2025
Last Seen
July 1, 2026

MacSync Stealer is a malware family tracked across 6 threat clusters and 16 intelligence report mentions on ThreatCluster. First observed November 12, 2025; most recent activity July 1, 2026.

Related Threat Clusters

Recent Intelligence Reports

  • A Weaponized Google Ad Install Malicious Claude Code to Hijack Entire macOS — Cybersecuritynews · July 1, 2026
  • MacSync Stealer Hijacks macOS via Fake Claude Code Google Ads — Gbhackers · July 1, 2026
  • Duncan said in the report — isc.sans.edu · May 4, 2026
  • Hackers replace top Google result for Homebrew with sponsored MacOS malware — Cybernews · May 4, 2026
  • Malicious Ad for Homebrew Leads to MacSync Stealer, (Fri, May 1st) — Isc.Sans.Edu · May 1, 2026
  • Security Bite: Trojan malware dominates Mac, now half of all detections, says Jamf — 9To5Mac · April 6, 2026
  • New MacSync Stealer Disguised as Trusted Mac App Hunts Saved Passwords — Hackread · December 23, 2025
  • MacSync Stealer malware bypasses macOS Gatekeeper security warnings — Csoonline · December 23, 2025

CVSS v3.1 Breakdown