Stealer Campaign Impacting SLTT macOS Users

Reported 09 Apr 2026 by otx · Severity: medium

MacSync Stealer is a macOS infostealer operating as Malware-as-a-Service (MaaS), distributed through SEO poisoning and fake ClickFix CAPTCHAs. The campaign has evolved through three iterations since November 2025, shifting from fake download sites to malicious ChatGPT conversatio