MacSync macOS Malware Distributed via Signed Swift Application

MacSync macOS malware has sharpened its delivery by packaging the dropper as a code-signed and notarized Swift application inside a disk image masquerading as a zk-Call messenger installer, according to Jamf. The developers, who rebranded from Mac.c (first seen in April 2025), added backdoor capabilities via a Go-based agent, and the campaign has infected hundreds of machines after appearing in mid-2025.

A key shift is that the dropper now retrieves an encoded script from a remote server and executes it through a Swift-built helper executable, a hands-off approach that no longer requires users to interact with the terminal, Jamf notes. The MacSync Stealer originally relied on social engineering such as ClickFix to lure users into running malicious scripts, but the latest variant reduces user involvement while maintaining its information-stealing and backdoor functionality. This evolution signals a broader trend in macOS malware to blend into signed and notarized executables, making the malicious app appear legitimate.