A Mac stealer hides behind fake dog trainers and fake AI startups — and the operator left one thing that never rotates
2026-08-19Security
Microsoft Defender Experts has tied 30-plus domains to MacSync, a macOS stealer delivered by getting people to paste a command into Terminal. It takes the Keychain, SSH keys, AWS credentials and Kubernetes configs. The build token changes every deployment; the API key does not, which is the whole detection.