Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
41 IOCs
MacSync under the microscope: new delivery methods and a new payload
Excerpt
MacSync is a relatively young, rapidly evolving family of crypto/info stealers. First advertised on the dark web in 2025 as Mac.c, the stealer was later renamed to MacSync by its creators. The initial versions were implemented as AppleScripts and closely resembled the AMOS stealer family, but over time, MacSync developed distinctive features of its own, including a backdoor module. In this report, we discuss a new infection chain that differs significantly from previous…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →41 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | https://toria.apple03cloudstore.com | High | Score 58/100 | First seen |
| MD5 | 2d69812584269699fade26622e6490c5 | Medium | Score 53/100 | First seen |
| MD5 | 3deeed48fd38f22e369f5c3092bd68a1 | Medium | Score 53/100 | First seen |
| MD5 | 7df1049cbd56c0bfa4a3364a379b4c2c | Medium | Score 53/100 | First seen |
| MD5 | fc3ba5ed282d77127efd0b0f2403531b | Medium | Score 53/100 | First seen |
| URL | https://streamyard.appstore.com.mx/installer.sh | High | Score 58/100 | First seen |
| MD5 | f97d24212fa6a21be0c4d211e10f044c | Medium | Score 53/100 | First seen |
| URL | https://docsend.appstore.com.mx/dcc737d157ef4271/Helper.pkg.enc | High | Score 58/100 | First seen |
| MD5 | 4203ec932bfcc0907f91732440d6d997 | Medium | Score 53/100 | First seen |
| URL | https://slack.apple03cloudstore.com/installer.sh | High | Score 58/100 | First seen |
| URL | https://toria.apple03cloudstore.com/ | High | Score 58/100 | First seen |
| MD5 | 09425f72de8bba18893dcd6f04115891 | Medium | Score 53/100 | First seen |
| MD5 | c53d0ea45dbc622afb7f16ea3eec78bc | Medium | Score 53/100 | First seen |
| SHA256 | cb09ff86cabde4f8cee2d3cdec370c623bfa6c2b72ae9750fc9a7b299c65d7ca | Medium | Score 53/100 | First seen |
| MD5 | 7212229c85852c3bffaf9740002b2f39 | Medium | Score 53/100 | First seen |
| MD5 | 3a1af2b397c6958e6c3ba3c75912d60e | Medium | Score 53/100 | First seen |
| URL | https://docsend.appstore.com.mx/dcc737d157ef4271/CoreUpdate.pkg.enc | High | Score 58/100 | First seen |
| URL | https://docsend.appstore.com.mx/dcc737d157ef4271/stage2.enc | High | Score 58/100 | First seen |
| URL | https://waaako.appstore.com.mx/installer.sh | High | Score 58/100 | First seen |
| MD5 | f9f70096aabb4d22a6657014f4853a53 | Medium | Score 53/100 | First seen |
| MD5 | 6791dad263cac6d63ebba6a4b57e7d71 | Medium | Score 53/100 | First seen |
| MD5 | eb760d5c88f13f7ee0f8f86ba3407123 | Medium | Score 53/100 | First seen |
| MD5 | 8d371f8a7a6dcc2655544ae13cbca03d | Medium | Score 53/100 | First seen |
| SHA256 | b8b4b88205a8f594b95a841bc37342898f34cad8a5a9e4a22ce69a31a1208650 | Medium | Score 53/100 | First seen |
| MD5 | 9f15fe9c4415cd668334339f705b94d8 | Medium | Score 53/100 | First seen |
| MD5 | 26a0f7cdb9f7dc5ace9a40af825b1538 | Medium | Score 53/100 | First seen |
| MD5 | 980e2134679bc0c609f7659882883d77 | Medium | Score 53/100 | First seen |
| URL | https://docsend.appstore.com.mx | High | Score 58/100 | First seen |
| SHA256 | 3744f975113dfc552df982dcae699f9154a448e05a743bdfb641a463352bc13a | Medium | Score 53/100 | First seen |
| MD5 | 8dc8561349d144d4661bc66f2ec49f9f | Medium | Score 53/100 | First seen |
| MD5 | fb90887592655a8c989e443c640167aa | Medium | Score 53/100 | First seen |
| SHA256 | ff664112d3215c5d184689fc836e0dc6c1a47e42c34e70b2c3d356864bc4cb4c | Medium | Score 53/100 | First seen |
| URL | https://toria.app/ | High | Score 58/100 | First seen |
| MD5 | 00d12d842596bf5ee1805effb4571d30 | Medium | Score 53/100 | First seen |
| URL | https://warpcast.asia/Toria.dmg | High | Score 58/100 | First seen |
| SHA256 | ff3ab9ef841630364818396f62e696b72aed162cf0b895b6643ef25dad79b51d | Medium | Score 53/100 | First seen |
| MD5 | 8e84b01d5ac9624f0b181ade0e737193 | Medium | Score 53/100 | First seen |
| URL | https://toria.apple03cloudstore.com/e3c1a6b00bc31e14/stage2.enc | High | Score 58/100 | First seen |
| MD5 | 781ce50001d4b449600afa347c9b0208 | Medium | Score 53/100 | First seen |
| MD5 | 9a0043d900a9ac78c886c59c9a328fd0 | Medium | Score 53/100 | First seen |
| MD5 | 3ded1d71a822b53b12c3b67bcaf633f5 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…