Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
4 IOCs
MacSync Stealer RAT Targets macOS With Credential Theft and Remote Access Capabilities
Excerpt
A newly documented macOS threat called MacSync combines credential theft, keychain harvesting, and a native remote access trojan into a single six-stage attack chain designed to drain victims’ browsers, accounts, and cryptocurrency wallets. Security researchers at Huntress uncovered the malware after investigating an intrusion in which a victim searching for Claude AI installation instructions was redirected via malicious advertising to run the malware. The infection…
Read the original report →Diamond Model
Adversary
Infrastructure(4)
Capability
Victim
Indicators of Compromise
Open the mindmap →4 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | malwareaudit.com | High | Score 58/100 | First seen |
| IP | 103.216.221.95 | High | Score 58/100 | First seen |
| Domain | agenticsora.com | High | Score 58/100 | First seen |
| IP | 85.206.161.241 | High | Score 86/100 | First seen |
IOC Relationship Graph
Building graph…