MacSync Malware Targets macOS Through Fake AI Tool Installers
Researchers have found three ClickFix campaigns spreading MacSync, a macOS malware that steals passwords, files, keychains, and cryptocurrency wallets. Instead of taking advantage of software flaws, these attacks trick users into running Terminal commands.
The campaigns used fake Google ads, ChatGPT conversations, and malicious pages to install MacSync, with the latest variant hiding in memory to avoid detection. Malware is often disguised as legitimate downloads or developer tools, making it especially effective against developers who use commands like curl | sh.
Multiple hacker groups, including KongTuke, attack WordPress sites with fake CAPTCHAs and browser errors to deliver malware like ModeloRAT, SHub Stealer, and CastleRAT. Over 250 trusted websites in 12+ countries have been hacked, putting sensitive data at risk of theft or further attacks.
For website administrators:
- Keep software, plugins, and themes up to date.
- Use strong, unique passwords.
- Enable two-factor authentication (2FA).
- Monitor admin accounts for suspicious activity.
For users:
- Stay cautious when browsing online.
- Avoid running unknown commands.
- Use reputable security software.
Key takeaway:
- Even trusted websites can be hacked, so always stay vigilant.
Source: https://thehackernews.com/2026/03/clickfix-campaigns-spread-macsync-macos.html