Quick Summary
The latest MacSync malware, delivered as a digitally signed Swift application, targets macOS systems and bypasses Gatekeeper checks. Security researchers from Jamf reported that this variant, named zk-call-messenger-installer-3.9.2-lts.dmg, uses sophisticated techniques to evade detection. The malware, which can steal sensitive data like iCloud credentials and passwords, was first identified in April 2025 and has since gained traction among macOS stealers.
The Securityish Brief
The new variant of the MacSync malware, identified by researchers at Jamf, is delivered through a digitally signed Swift application that bypasses macOS Gatekeeper checks. This malware is distributed via a disk image named zk-call-messenger-installer-3.9.2-lts.dmg, which was found to have a valid signature associated with the Developer Team ID GNJLS3UYZ4. The malware’s ability to evade Gatekeeper represents a significant evolution from previous versions that relied on less sophisticated methods.
Jamf’s analysis revealed that the MacSync malware dropper uses encoded forms to deliver its payload. After decoding, researchers identified the malware’s typical features, including mechanisms to evade detection, such as inflating the disk image size by embedding decoy PDFs and performing connectivity checks before execution. The malware was first detected in April 2025 and was linked to a threat actor known as ‘Mentalpositive’.
By July 2025, this malware had gained traction in the macOS cybercrime ecosystem, joining other notable malware like AMOS and Odyssey. Previous analyses indicate that the MacSync Stealer can compromise sensitive information, including iCloud keychain credentials, web browser passwords, and cryptocurrency wallet data.
The introduction of stricter app notarization policies in macOS 10.14.5 and later has influenced the development of this malware, as noted by its creator in a September interview. This highlights the ongoing cat-and-mouse game between malware developers and security measures.
Implications for Users and Organizations
This incident underscores the evolving tactics used by malware developers to bypass security measures, which can have serious implications for macOS users. The use of valid digital signatures to deliver malicious software can mislead users into believing they are installing legitimate applications.
Users should be vigilant about the sources from which they download software, as even seemingly legitimate applications can harbor malware. Organizations must ensure that their security protocols are updated to detect and mitigate such threats effectively.
Regular monitoring of system activity and user behavior can help identify potential breaches early. Additionally, educating users about the risks associated with downloading software from unverified sources is crucial in maintaining security.
Key Takeaways
- Verify the source of any software downloads, especially if they are from lesser-known websites.
- Regularly update macOS and all applications to ensure the latest security patches are applied.
- Educate users on recognizing signs of malware and phishing attempts.
- Implement monitoring tools to detect unusual activity on macOS systems.
- Consider using additional security software that can provide an extra layer of protection against malware.
Key Terms & Concepts
- MacSync: In this article, MacSync refers to a type of malware targeting macOS systems that steals sensitive information.
- Gatekeeper: Gatekeeper is a security feature in macOS designed to ensure that only trusted software runs on the system.
- notarization: Notarization is a process by which Apple verifies that an application is free from known malware before it can be distributed.
- payload: In this context, payload refers to the malicious code delivered by the MacSync malware that performs harmful actions on the infected system.
- threat actor: A threat actor is an individual or group responsible for malicious activities, such as deploying malware.
Read the original article here: https://www.bleepingcomputer.com/news/security/new-macsync-malware-dropper-evades-macos-gatekeeper-checks/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
