New MacSync macOS Stealer Uses Signed App to Bypass Apple Gatekeeper

Cybersecurity researchers have uncovered a new variant of the MacSync macOS information stealer, delivered via a digitally signed, notarised Swift application masquerading as a messaging app installer to bypass Apple’s Gatekeeper checks.

According to Jamf, the latest sample is distributed as a code-signed and notarised Swift application within a disk image named "zk-call-messenger-installer-3.9.2-lts.dmg" hosted on zkcall[.]net/download, and it runs without being blocked by Gatekeeper or XProtect, although it still prompts users to right‑click and open the app to bypass safeguards. Apple has since revoked the code signing certificate used.

The dropper then downloads and executes an encoded script after performing checks, including verifying internet connectivity and enforcing a minimum execution interval of around 3600 seconds, while removing quarantine attributes and validating the file prior to execution. The curl command used to fetch the payload shows deviations from earlier variants, with flags split into -fL and -sS and the addition of --noproxy.

Moonlock Lab notes that the Base64 payload corresponds to MacSync, a rebranded version of Mac.c first seen in April 2025, which is equipped with a Go-based agent enabling remote command and control.