SlowMist: The macOS malware "MacSync Stealer" is currently active and highly destructive

Foresight News reported, according to monitoring by blockchain security firm SlowMist, MistEye has received threat intelligence from the community indicating that a piece of malware named “MacSync Stealer” (v1.1.2) is currently active and highly destructive. This malware targets macOS users and steals sensitive data, including crypto wallets, browser credentials, system keychain, and infrastructure keys (SSH/AWS/K8s). The malware uses fake AppleScript system dialogs for phishing, and after leaking data, displays a fake "unsupported" error message. The relevant Indicator of Compromise (IOC) has already been promptly shared with clients. Do not execute unverified macOS scripts, and remain highly alert to unexpected system password prompts. If you suspect an attack, immediate remediation is required: change all infrastructure credentials (SSH/AWS/K8s), invalidate any exposed keychains, and rapidly transfer crypto assets to a secure wallet.