Recently, the security community shared an important warning: the MacSync Stealer malware active on the macOS platform has completed a rather covert technical upgrade.

From the earlier low-level "drag to terminal" and "ClickFix" inducement techniques, this has evolved into legitimate code signing + Apple notarized (notarized) Swift applications. It looks like a legitimate software because it has gained higher "trustworthiness" under Apple's protective framework—this is the most dangerous aspect.

What makes it even trickier is that the method of spread has become smarter. Malware is disguised as the zk-call-messenger-installer-3.9.2-lts.dmg file, posing as an instant messaging tool to attract you to download it. Moreover, the new version is particularly cunning—there's no need for users to type commands in the terminal; all the dirty work is handled by the built-in Swift helper program, which pulls scripts from a remote server to execute and complete data theft.

Security researchers pointed out that the developer team ID of this sample is GNJLS3UYZ4, and the related hash has not yet been revoked by Apple. This means that under the default macOS security mechanisms, it can easily bypass the vigilance of most users. The sample also employs a particular sleight of hand— the DMG file is unusually large, stuffed with PDF files related to LibreOffice as a cover.

Users have already lost assets because of this. macOS users should not let their guard down and think twice when downloading applications.