Reverse Engineering the Six Stages of MacSync Stealer and RAT

Reported 29 Jul 2026 by otx · Severity: medium

MacSync is a sophisticated six-stage macOS attack chain initiated when victims search for Claude installation instructions, click malicious Google Ads, and reach weaponized claude.ai/share conversations posing as Apple Support guides. The victim pastes a curl command that deploys