Skip to main content
IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Exposure
4 IOCs

MacSync Stealer RAT Targets macOS With Credential Theft and Remote Access Capabilities

Cyber Press
Cyber Press
Published August 1, 2026Original Report

Excerpt

A newly documented macOS threat called MacSync combines credential theft, keychain harvesting, and a native remote access trojan into a single six-stage attack chain designed to drain victims’ browsers, accounts, and cryptocurrency wallets. Security researchers at Huntress uncovered the malware after investigating an intrusion in which a victim searching for Claude AI installation instructions was redirected via malicious advertising to run the malware. The infection…

Read the original report →

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYunknownINFRASTRUCTUREmalwareaudit.com103.216.221.95agenticsora.comCAPABILITYunknownVICTIMunknown
Adversary
Infrastructure(4)
Capability
Victim

Indicators of Compromise

Open the mindmap →

4 indicators

TypeIndicatorConfidenceScoreFirst Seen
Domainmalwareaudit.comHighScore 58/100First seen
IP103.216.221.95HighScore 58/100First seen
Domainagenticsora.comHighScore 58/100First seen
IP85.206.161.241HighScore 86/100First seen

IOC Relationship Graph

Building graph…