The Notarized Nightmare: New MacSync Stealer Bypasses Gatekeeper to Hijack Mac Devices

The Notarized Nightmare: New MacSync Stealer Bypasses Gatekeeper to Hijack Mac Devices reports that a new MacSync Stealer variant has moved to an automated infection process hidden inside legitimate-looking applications, shedding reliance on user actions. The malicious dropper was found in a disk image named zk-call-messenger-installer-3.9.2-lts.dmg and was distributed via a look-alike site, with the code-signed and notarized Swift application enabling installation without direct terminal interaction.

According to Jamf Threat Labs, the Mach-O binary is both code signed and notarized, with the certificate linked to Developer Team ID GNJLS3UYZ4, which helped bypass macOS Gatekeeper and created a veneer of legitimacy. The malware conducts a preflight check for an internet connection and employs a rate-limiting mechanism, executing only if it has not run within the last hour, before downloading a payload to /tmp/runner, validating it as a shell script and removing the quarantine attribute before execution.

The payload then connects to known malicious domains such as focusgroovy[.]com, marking a notable evolution in MacSync campaigns by embedding into signed, notarized software to evade early detection.