malware
MacSync under the microscope: new delivery methods and a new payload
Medium
Summary
MacSync, a rapidly evolving crypto/info stealer, has shifted its delivery methods, moving away from AppleScripts to binary-based DMG images. The latest version utilizes a complex infection chain involving a dropper, a backdoor, and an infostealer, leveraging techniques like PAM-based password verification and iCloud calendar exploitation. The malware employs a PAM-based password verification method, a relatively new technique for macOS malware.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data