Detecting MacSync: macOS ClickFix Infostealer Abusing LaunchAgent Persistence

Microsoft Threat Intelligence has been tracking a macOS ClickFix operation that, as of early August 2026, spans more than 250 front-end domains. What makes this cluster notable is not the lure itself — fake AI-tool installers and utility “fixes” are now a well-worn macOS infection vector — but the delivery infrastructure’s evolution into a server-side browser-fingerprinting gate. Visitors are profiled before the page decides whether to show a malicious download prompt at all, which hides the lure from crawlers, sandboxes, and most automated analysis pipelines while still reaching real Mac users. The payload delivered through this infrastructure includes both MacSync, a purpose-built macOS stealer-and-RAT, and Atomic Stealer (AMOS).

The attack still requires a human to do the damage: the ClickFix page instructs the victim to open Terminal and paste an obfuscated command. From there, execution is entirely living-off-the-land — curl, bash, osascript, and gunzip — right up until a Mach-O RAT is dropped and set to persist via LaunchAgent. That gives defenders a well-defined, if narrow, detection window before the stealer starts exfiltrating credentials, browser data, and crypto wallets.

The MacSync Attack Chain

Lure and gate: A fingerprinting front-end domain serves a fake “fix this error” or fake AI-tool-installer page only to browsers that look like a genuine macOS session.
Clipboard-to-Terminal execution: The victim copies a command from the page and pastes it into Terminal (the canonical ClickFix pattern, just macOS’s Terminal.app instead of Windows Run/PowerShell).
Stage 1 — profiler/loader: A bash one-liner using curl (commonly with -k, -s, --max-time, or --data-binary flags) collects system details (macOS version, hardware model, installed security tools) and reports back before fetching the next stage.
Stage 2 — architecture-matched payload: The loader retrieves a Mach-O binary matched to the victim’s processor (Apple Silicon or Intel), frequently staged through base64-encoded or gzip-compressed blobs decoded on the endpoint.
osascript-assisted execution: AppleScript via osascript is used to run shell commands, display fake system dialogs (e.g., a spoofed password prompt to harvest the login keychain password), or bypass Gatekeeper prompts with user-approved clicks.
Persistence: A LaunchAgent plist is written to ~/Library/LaunchAgents/, frequently mimicking a legitimate updater label (Google Keystone, Adobe ARM/AAM Updater) so it blends into normal login-item review.
Collection and exfiltration: The Mach-O RAT harvests browser-stored credentials and cookies, Keychain items, Apple Notes, and crypto wallet files, then archives and exfiltrates them to attacker infrastructure.

Detection Surfaces

macOS endpoint telemetry for this chain comes from three practical sources depending on your stack: the EndpointSecurity framework (consumed by most third-party EDR — CrowdStrike Falcon, SentinelOne, Jamf Protect), osquery if you’re running it fleet-wide, and Microsoft Defender for Endpoint, which now covers macOS process telemetry in DeviceProcessEvents the same way it does Windows.

Sigma Rule — Terminal-Spawned curl Piped to Shell (ClickFix Loader Pattern)

title: Suspicious curl-to-Shell Execution from Terminal (macOS ClickFix)
id: 7f2a4c11-9d3e-4a67-b6c2-1e8f5d9a3c40
status: experimental
description: Detects curl downloading and piping content into bash/sh from an interactive Terminal session, consistent with ClickFix stage-1 loader execution on macOS
author: SOC Analyst Hub
date: 2026-08-19
tags:
  - attack.execution
  - attack.t1204.004
  - attack.t1059.002
logsource:
  category: process_creation
  product: macos
detection:
  selection_curl:
    Image|endswith: '/curl'
    CommandLine|contains:
      - '-o-'
      - '--output -'
      - '-s'
  selection_pipe_shell:
    ParentImage|endswith:
      - '/bash'
      - '/sh'
      - '/zsh'
  selection_parent_interactive:
    ParentCommandLine|contains:
      - 'Terminal'
      - '/bin/bash -c'
      - '/bin/zsh -c'
  condition: selection_curl and selection_pipe_shell and selection_parent_interactive
falsepositives:
  - Legitimate install scripts distributed as "curl | bash" one-liners (Homebrew formulae, dev tooling) — validate destination domain against known-good package sources
level: medium

Sigma Rule — LaunchAgent Written by Non-Installer Process

title: LaunchAgent Plist Created Outside Package Installer Context (macOS)
id: 8a3b5d22-1e4f-4b78-c7d3-2f9a6e0b4d51
status: experimental
description: Detects creation of a LaunchAgent plist in the user Library by a process other than installer/pkg utilities, a common MacSync persistence step masquerading as a legitimate updater
author: SOC Analyst Hub
date: 2026-08-19
tags:
  - attack.persistence
  - attack.t1546.001
logsource:
  category: file_event
  product: macos
detection:
  selection_path:
    TargetFilename|contains: '/Library/LaunchAgents/'
    TargetFilename|endswith: '.plist'
  filter_legit_processes:
    Image|endswith:
      - '/installer'
      - '/softwareupdated'
      - '/Install Command Line Developer Tools.app/Contents/MacOS/Install Command Line Developer Tools'
  condition: selection_path and not filter_legit_processes
falsepositives:
  - Legitimate third-party app updaters installing their own LaunchAgent for the first time (verify signature and label naming)
level: medium

Sigma Rule — osascript Invoking Shell with Encoded Payload

title: osascript Executing Shell Command with Base64/Gzip Payload (macOS)
id: 9c4d6e33-2f5a-4c89-d8e4-3a0b7f1c5e62
status: experimental
description: Detects osascript used to run shell commands that decode base64 or decompress gzip content, consistent with MacSync stage-2 payload staging
author: SOC Analyst Hub
date: 2026-08-19
tags:
  - attack.execution
  - attack.defense_evasion
  - attack.t1059.002
  - attack.t1027
logsource:
  category: process_creation
  product: macos
detection:
  selection_osascript:
    Image|endswith: '/osascript'
    CommandLine|contains: 'do shell script'
  selection_encoded:
    CommandLine|contains:
      - 'base64 -D'
      - 'base64 --decode'
      - 'gunzip'
      - 'openssl enc -d'
  condition: selection_osascript and selection_encoded
falsepositives:
  - Rare in legitimate automation; review any hits against known internal AppleScript tooling
level: high

KQL for Microsoft Defender for Endpoint (macOS)

// MacSync: curl piped into a shell from an interactive Terminal-spawned process
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("bash", "sh", "zsh")
| where FileName =~ "curl"
| where ProcessCommandLine has_any ("-o-", "--output -", "-s ")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

// MacSync: LaunchAgent plist written under user Library, excluding known installer processes
DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath has "/Library/LaunchAgents/"
| where FileName endswith ".plist"
| where InitiatingProcessFileName !in~ ("installer", "softwareupdated")
| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

// MacSync: osascript "do shell script" with encoded payload indicators
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "osascript"
| where ProcessCommandLine has "do shell script"
| where ProcessCommandLine has_any ("base64", "gunzip", "openssl enc")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| order by Timestamp desc

Threat Hunting: Unified Logging on the Endpoint

If you have shell access (IR engagement, EDR live-response) rather than centralized telemetry, Apple’s Unified Logging captures much of this chain locally. Pull recent Terminal-initiated process activity with:

log show --predicate 'process == "curl" OR process == "osascript"' --info --last 24h

Pair this with a check of LaunchAgents installed in the last 24 hours against a known-good baseline:

find ~/Library/LaunchAgents /Library/LaunchAgents -newer /tmp/baseline_marker -name "*.plist" -exec plutil -p {} \;

Flag any label that mimics a legitimate vendor (com.google.keystone.*, com.adobe.ARM.*) but points its ProgramArguments at a binary outside the vendor’s normal install path (/Applications/, /Library/Application Support/) — MacSync’s persistence relies on the label passing a casual glance, not the executable path.

Behavioural Context That Improves Fidelity

Terminal.app or a shell process spawning within seconds of browser activity to a newly-registered or low-reputation domain
curl/osascript execution with no corresponding entry in shell history predating the session (fresh paste, not typed)
A LaunchAgent label matching a known updater but its executable hash not matching that vendor’s signed binary
Outbound connections from the new LaunchAgent-launched process to non-Apple, non-vendor infrastructure shortly after login

Mitigations

Enable Gatekeeper and XProtect enforcement fleet-wide; while ClickFix bypasses download-quarantine warnings by having the user execute code directly, XProtect’s behavioral signatures still catch known Mach-O payload families once written to disk
Restrict or log Terminal.app usage on managed non-developer endpoints via MDM (Jamf, Kandji) where operationally feasible
Deploy EndpointSecurity-based EDR with process and file-write telemetry rather than relying on XProtect alone
Baseline LaunchAgents/LaunchDaemons per fleet and alert on any new entry that doesn’t match your software deployment tooling
User awareness: train users that no legitimate macOS fix, update, or CAPTCHA verification ever requires pasting a command into Terminal

MacSync succeeds for the same structural reason ClickFix succeeds on Windows: the payload arrives through user-authorized execution, not exploitation, so there’s no vulnerable software to patch. Detection has to shift to the process ancestry and persistence artefacts the chain leaves behind — curl-to-shell from an interactive Terminal session, osascript decoding staged payloads, and LaunchAgents that don’t match your fleet baseline.