New MacSync Malware Turns macOS Apps Into Tools for Crypto and Password Theft

MacSync, a fast-changing macOS information stealer, has returned with a more complex delivery chain aimed at people who use cryptocurrency and developer tools. Instead of relying mainly on a pasted Terminal command, the latest activity begins with malicious disk-image files that pose as real applications. Operators can vary delivery between campaigns. Victims can encounter the malware through fake or cracked software, including a nonexistent crypto wallet application called Toria. Once opened, the app can strip macOS quarantine attributes, fetch more code, and ultimately install tools built to steal passwords, wallet data, and work-related credentials. Attackers promoted the…