{ "intelligence": { "actors": [], "counts": { "actors": 0, "associated_entity_contexts": 4, "deduplicated_iocs": 9, "direct_entities": 54, "direct_relationships": 134, "invalid_iocs": 0, "iocs": 9, "mentioned": 17, "mitre_associated": 13, "mitre_direct": 0, "targets": 15, "techniques": 0, "unsupported_indicators": 4, "vulnerabilities": 0 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 594, "excluded_graph_objects": 299, "graph_complete": true, "graph_objects": 54, "graph_relationships": 134, "mitre_context_complete": true, "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "status_as_of": "2026-10-10T15:49:36+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.214Z", "created_at": "2026-09-25T22:33:41.319Z", "modified": "2026-09-25T22:33:53.010Z", "updated_at": "2026-09-25T22:33:53.010Z" }, "description_available": false, "entity_type": "Indicator", "id": "0284f8d3-8d1e-4099-b425-1dfdf3756b24", "is_inferred": false, "labels": [ "applescript", "clickfix", "credential theft", "cryptocurrency wallets", "lummac2", "maas", "macos stealer", "macsync", "obfuscation", "social engineering", "stealc", "vidar" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "indicator--574d8477-157b-5588-b4e1-5ab0b97f6593", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.219Z", "created_at": "2026-09-25T22:33:42.495Z", "modified": "2026-09-25T22:33:57.679Z", "updated_at": "2026-09-25T22:33:57.679Z" }, "description_available": false, "entity_type": "Indicator", "id": "05249b1e-20c2-4d0c-8b6b-042029a7e4e6", "is_inferred": false, "labels": [ "applescript", "clickfix", "credential theft", "cryptocurrency wallets", "lummac2", "maas", "macos stealer", "macsync", "obfuscation", "social engineering", "stealc", "vidar" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "indicator--db9f2f35-74fc-5a73-a3a0-f53e670c38ae", "type": "Indicator" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.014Z", "created_at": "2026-01-18T14:36:09.111Z", "modified": "2026-01-18T14:36:09.339Z", "updated_at": "2026-01-18T14:36:09.339Z" }, "description_available": false, "entity_type": "Region", "id": "0584d53c-836c-41a4-a732-0edcc5dea653", "is_inferred": false, "labels": [], "lang": "en", "name": "Americas", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "location--bce21a59-810c-5c81-863c-23546cb0d6a0", "type": "Region" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.043Z", "created_at": "2026-01-18T14:36:33.627Z", "modified": "2026-01-18T14:36:33.875Z", "updated_at": "2026-01-18T14:36:33.875Z" }, "description_available": false, "entity_type": "Region", "id": "0edd7cee-c750-4a70-82dc-a493fef311a8", "is_inferred": false, "labels": [], "lang": "en", "name": "Southern Asia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "location--80f5d85d-4b4f-5cb7-b7aa-1771c0afad2e", "type": "Region" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.060Z", "created_at": "2026-01-18T14:36:53.793Z", "modified": "2026-01-18T14:36:54.026Z", "updated_at": "2026-01-18T14:36:54.026Z" }, "description_available": false, "entity_type": "Region", "id": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "is_inferred": false, "labels": [], "lang": "en", "name": "Western Europe", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "location--a25f43bf-3e2d-55fe-ba09-c63a210f169d", "type": "Region" }, { "__typename": "Country", "aliases": [ "SG", "SGP" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.042Z", "created_at": "2026-01-18T14:36:31.418Z", "modified": "2026-01-25T16:24:27.190Z", "updated_at": "2026-01-25T16:24:27.190Z" }, "description_available": false, "entity_type": "Country", "id": "1dd71a00-5740-4802-b05e-d76e46b5469c", "is_inferred": false, "labels": [], "lang": "en", "name": "Singapore", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "location--9bf6838e-5018-591f-9839-037ff74bc819", "type": "Country" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.206Z", "created_at": "2026-09-25T22:33:39.777Z", "modified": "2026-09-25T22:33:46.629Z", "updated_at": "2026-09-25T22:33:46.629Z" }, "description_available": false, "entity_type": "Indicator", "id": "1e66c154-5bf9-4459-a289-4958e39f1a31", "is_inferred": false, "labels": [ "applescript", "clickfix", "credential theft", "cryptocurrency wallets", "lummac2", "maas", "macos stealer", "macsync", "obfuscation", "social engineering", "stealc", "vidar" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "indicator--3406bedd-bd25-53d6-9618-fc243cfcd2c5", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.209Z", "created_at": "2026-09-25T22:33:40.538Z", "modified": "2026-09-25T22:33:50.895Z", "updated_at": "2026-09-25T22:33:50.895Z" }, "description_available": false, "entity_type": "Indicator", "id": "24fc8125-aab7-470f-97fd-f7d447ba5095", "is_inferred": false, "labels": [ "applescript", "clickfix", "credential theft", "cryptocurrency wallets", "lummac2", "maas", "macos stealer", "macsync", "obfuscation", "social engineering", "stealc", "vidar" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "indicator--78f069b5-877e-5de2-a906-7c3a5bb29870", "type": "Indicator" }, { "__typename": "Sector", "aliases": [ "Bitcoin", "Crypto", "Cryptocurrency", "Currency Exchange", "IT", "Information Security", "Software Development", "Technology", "Virtual Currency", "Vulnerability Research", "software" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.394Z", "created_at": "2026-01-18T14:35:11.762Z", "modified": "2026-03-09T09:41:22.635Z", "updated_at": "2026-03-09T09:41:22.635Z" }, "description_available": true, "entity_type": "Sector", "id": "25243a50-06ec-4c1b-8fb2-6a96793e8404", "is_inferred": false, "labels": [], "lang": "en", "name": "Technologies", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "identity--dcacaabc-1244-51fd-8e75-59f4a6fe0aad", "type": "Sector" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.062Z", "created_at": "2026-01-18T14:36:56.218Z", "modified": "2026-01-18T14:36:56.551Z", "updated_at": "2026-01-18T14:36:56.551Z" }, "description_available": false, "entity_type": "Region", "id": "2730372a-ef6c-4210-bc27-805102dc639f", "is_inferred": false, "labels": [], "lang": "en", "name": "Australia and New Zealand", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "location--8d7fec7f-4e38-53c6-a3dc-904adf4622e8", "type": "Region" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:33:32.114Z", "updated_at": "2026-09-25T22:33:32.650Z" }, "description_available": false, "entity_type": "StixFile", "id": "27771ccd-ca69-4e78-b3e8-22c098f5e1b6", "is_inferred": false, "labels": [ "applescript", "clickfix", "credential theft", "cryptocurrency wallets", "lummac2", "maas", "macos stealer", "macsync", "obfuscation", "social engineering", "stealc", "vidar" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "file--5924ee23-35f6-5d88-9fb6-aa4e17fe31eb", "type": "StixFile" }, { "__typename": "Country", "aliases": [ "FR", "FRA" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.061Z", "created_at": "2026-01-18T14:36:54.393Z", "modified": "2026-01-26T00:00:25.167Z", "updated_at": "2026-01-26T00:00:25.167Z" }, "description_available": false, "entity_type": "Country", "id": "28acec63-0804-49d2-95fa-8beb12f12b33", "is_inferred": false, "labels": [], "lang": "en", "name": "France", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "location--b8d0549f-de06-5ebd-a6e9-d31a581dba5d", "type": "Country" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.001Z", "created_at": "2026-01-18T14:35:45.994Z", "modified": "2026-01-18T14:35:46.389Z", "updated_at": "2026-01-18T14:35:46.389Z" }, "description_available": false, "entity_type": "Region", "id": "2ddebcb7-f192-4ba6-9d42-5f830cffc4c8", "is_inferred": false, "labels": [], "lang": "en", "name": "Sub-Saharan Africa", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "location--69cc1e68-fe91-514a-84c6-3379e0109bc3", "type": "Region" }, { "__typename": "Country", "aliases": [ "CA", "CAN" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.033Z", "created_at": "2026-01-18T14:36:25.255Z", "modified": "2026-01-25T17:05:26.550Z", "updated_at": "2026-01-25T17:05:26.550Z" }, "description_available": false, "entity_type": "Country", "id": "2f8a4ddc-793d-43b9-a7fc-a29d93a0db1d", "is_inferred": false, "labels": [], "lang": "en", "name": "Canada", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "location--894bf7fe-35e0-5bdb-80b9-ca64177e6d1c", "type": "Country" }, { "__typename": "Country", "aliases": [ "US", "USA" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.034Z", "created_at": "2026-01-18T14:36:25.804Z", "modified": "2026-01-20T20:57:15.092Z", "updated_at": "2026-01-20T20:57:15.092Z" }, "description_available": false, "entity_type": "Country", "id": "3460c7f0-1521-461b-af64-2de060664fb1", "is_inferred": false, "labels": [], "lang": "en", "name": "United States of America", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "location--e79b4cf1-a256-5efa-bc74-c94c7c7ffde0", "type": "Country" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.032Z", "created_at": "2026-01-18T14:36:24.671Z", "modified": "2026-01-18T14:36:24.965Z", "updated_at": "2026-01-18T14:36:24.965Z" }, "description_available": false, "entity_type": "Region", "id": "3f84bc21-010c-46a3-bad3-432dcd70f556", "is_inferred": false, "labels": [], "lang": "en", "name": "Northern America", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "location--713e5fdc-da7b-5735-958d-d7dc664efa7f", "type": "Region" }, { "__typename": "Country", "aliases": [ "AU", "AUS" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.062Z", "created_at": "2026-01-18T14:36:56.389Z", "modified": "2026-01-26T07:42:24.959Z", "updated_at": "2026-01-26T07:42:24.959Z" }, "description_available": false, "entity_type": "Country", "id": "402b2086-638d-4a79-88bb-c79acff485d8", "is_inferred": false, "labels": [], "lang": "en", "name": "Australia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "location--6004efb1-d850-551c-af0d-4717244377a8", "type": "Country" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:33:32.004Z", "updated_at": "2026-09-25T22:33:32.365Z" }, "description_available": false, "entity_type": "StixFile", "id": "40b040e5-25fc-4c6a-8115-b018daedcce1", "is_inferred": false, "labels": [ "applescript", "clickfix", "credential theft", "cryptocurrency wallets", "lummac2", "maas", "macos stealer", "macsync", "obfuscation", "social engineering", "stealc", "vidar" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "file--cdc5d658-3536-5cd9-b911-6c4474ea0a5b", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.201Z", "created_at": "2026-09-25T22:33:37.200Z", "modified": "2026-09-25T22:33:42.211Z", "updated_at": "2026-09-25T22:33:42.211Z" }, "description_available": false, "entity_type": "Indicator", "id": "46793d9f-2092-4522-909c-16fbded66c1b", "is_inferred": false, "labels": [ "applescript", "clickfix", "credential theft", "cryptocurrency wallets", "lummac2", "maas", "macos stealer", "macsync", "obfuscation", "social engineering", "stealc", "vidar" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "indicator--d3f48d1b-9ca9-59b7-971a-37858fe9c0f3", "type": "Indicator" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:33:36.029Z", "updated_at": "2026-09-25T22:33:36.398Z" }, "description_available": false, "entity_type": "Hostname", "id": "501e7702-f8eb-4444-af95-c9a147450a5a", "is_inferred": false, "labels": [ "applescript", "clickfix", "credential theft", "cryptocurrency wallets", "lummac2", "maas", "macos stealer", "macsync", "obfuscation", "social engineering", "stealc", "vidar" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "hostname--879ab405-6a93-59b3-81de-8b723a1e12a8", "type": "Hostname" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-08-09T14:59:12.764Z", "updated_at": "2026-09-25T22:33:31.534Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "53cb35b0-94d2-4d7a-9c08-fe0aa0430190", "is_inferred": false, "labels": [ "applescript", "claude platform abuse", "clickfix", "credential stealing", "credential theft", "cryptocurrency theft", "cryptocurrency wallets", "lummac2", "maas", "macos stealer", "macos targeting", "macsync", "macsync stealer", "malvertising", "obfuscation", "shared chat abuse", "social engineering", "stealc", "vidar" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "domain-name--c0ccb71c-18c7-5d49-979d-7db243f4199a", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.203Z", "created_at": "2026-09-25T22:33:37.648Z", "modified": "2026-09-25T22:33:44.257Z", "updated_at": "2026-09-25T22:33:44.257Z" }, "description_available": false, "entity_type": "Indicator", "id": "53db8b3c-0fa9-4f49-ad94-7ddbe4261845", "is_inferred": false, "labels": [ "applescript", "clickfix", "credential theft", "cryptocurrency wallets", "lummac2", "maas", "macos stealer", "macsync", "obfuscation", "social engineering", "stealc", "vidar" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "indicator--d40bfc58-04cc-568c-aa0c-9f141ed850c8", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.224Z", "created_at": "2026-09-25T22:33:44.556Z", "modified": "2026-09-25T22:34:02.501Z", "updated_at": "2026-09-25T22:34:02.501Z" }, "description_available": false, "entity_type": "Indicator", "id": "57747752-926b-47ee-90bf-07f8084c6ca2", "is_inferred": false, "labels": [ "applescript", "clickfix", "credential theft", "cryptocurrency wallets", "lummac2", "maas", "macos stealer", "macsync", "obfuscation", "social engineering", "stealc", "vidar" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "indicator--c393e8ee-30a3-5fef-aa77-82f05ba7cfb0", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:33:33.347Z", "updated_at": "2026-09-25T22:33:34.933Z" }, "description_available": false, "entity_type": "StixFile", "id": "593f83b0-dd55-42da-92bb-4d803401255e", "is_inferred": false, "labels": [ "applescript", "clickfix", "credential theft", "cryptocurrency wallets", "lummac2", "maas", "macos stealer", "macsync", "obfuscation", "social engineering", "stealc", "vidar" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "file--91de5340-7320-5367-a53d-813080334226", "type": "StixFile" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.038Z", "created_at": "2026-01-18T14:36:27.648Z", "modified": "2026-01-18T14:36:28.240Z", "updated_at": "2026-01-18T14:36:28.240Z" }, "description_available": false, "entity_type": "Region", "id": "5e22af61-1616-46dc-b076-551e7f99593f", "is_inferred": false, "labels": [], "lang": "en", "name": "Eastern Asia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "location--c5a2d626-2be3-5cee-b643-773a32d19ce0", "type": "Region" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.211Z", "created_at": "2026-09-25T22:33:40.543Z", "modified": "2026-09-25T22:33:48.492Z", "updated_at": "2026-09-25T22:33:48.492Z" }, "description_available": false, "entity_type": "Indicator", "id": "6153c912-e546-4292-b04a-e680a4e39367", "is_inferred": false, "labels": [ "applescript", "clickfix", "credential theft", "cryptocurrency wallets", "lummac2", "maas", "macos stealer", "macsync", "obfuscation", "social engineering", "stealc", "vidar" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "indicator--91af9c89-6746-557c-a1e1-4805f98ded2d", "type": "Indicator" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T18:15:56.981Z", "created_at": "2026-02-26T09:06:06.821Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-02-26T09:06:08.284Z", "updated_at": "2026-02-26T09:06:08.284Z" }, "description_available": false, "entity_type": "Malware", "id": "65de75f2-577f-475e-9394-05450cc05a45", "is_inferred": false, "labels": [], "lang": "en", "name": "LummaC2", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "malware--58dd33b2-647b-5c42-89e8-09b5f64b9469", "type": "Malware" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:33:36.364Z", "updated_at": "2026-09-25T22:33:36.723Z" }, "description_available": false, "entity_type": "Hostname", "id": "67b9028f-0370-4be1-bc1a-6fd14683c6a8", "is_inferred": false, "labels": [ "applescript", "clickfix", "credential theft", "cryptocurrency wallets", "lummac2", "maas", "macos stealer", "macsync", "obfuscation", "social engineering", "stealc", "vidar" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "hostname--90b8b987-df5d-5855-aba7-672dd96ade50", "type": "Hostname" }, { "__typename": "Sector", "aliases": [ "Financial", "Financial Industry (FI)", "Financial Services", "Financial-Services" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.391Z", "created_at": "2026-01-18T14:35:07.063Z", "modified": "2026-01-22T20:49:24.280Z", "updated_at": "2026-01-22T20:49:24.280Z" }, "description_available": true, "entity_type": "Sector", "id": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "is_inferred": false, "labels": [], "lang": "en", "name": "Finance", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "identity--283d4ea0-b6f1-5421-bdab-117a33fdb2b7", "type": "Sector" }, { "__typename": "Country", "aliases": [ "IN", "IND" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.044Z", "created_at": "2026-01-18T14:36:34.563Z", "modified": "2026-01-26T13:48:21.782Z", "updated_at": "2026-01-26T13:48:21.782Z" }, "description_available": false, "entity_type": "Country", "id": "6926835d-28e0-4787-97c9-699d0375b12b", "is_inferred": false, "labels": [], "lang": "en", "name": "India", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "location--0bd9fe72-1184-515b-98b8-6341b3b27996", "type": "Country" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.062Z", "created_at": "2026-01-18T14:36:55.954Z", "modified": "2026-01-18T14:36:56.120Z", "updated_at": "2026-01-18T14:36:56.120Z" }, "description_available": false, "entity_type": "Region", "id": "6c3ce996-c654-4b25-8b6d-f983459d54a6", "is_inferred": false, "labels": [], "lang": "en", "name": "Oceania", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "location--834c5189-3715-561b-b68a-e835372d05ff", "type": "Region" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.049Z", "created_at": "2026-01-18T14:36:42.591Z", "modified": "2026-01-18T14:36:42.746Z", "updated_at": "2026-01-18T14:36:42.746Z" }, "description_available": false, "entity_type": "Region", "id": "6e23d1d1-9fea-43f8-a01c-f1b416f6e558", "is_inferred": false, "labels": [], "lang": "en", "name": "Europe", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "location--2e9ef300-a1ab-5c9f-9297-dde66b71cae2", "type": "Region" }, { "__typename": "Country", "aliases": [ "JP", "JPN" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.040Z", "created_at": "2026-01-18T14:36:28.776Z", "modified": "2026-01-25T16:24:47.859Z", "updated_at": "2026-01-25T16:24:47.859Z" }, "description_available": false, "entity_type": "Country", "id": "7a370bce-880b-477d-b87c-2fc78164dde9", "is_inferred": false, "labels": [], "lang": "en", "name": "Japan", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "location--5c26fa61-1bce-5286-900c-9ac7d4d93276", "type": "Country" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.035Z", "created_at": "2026-01-18T14:36:26.119Z", "modified": "2026-01-18T14:36:26.275Z", "updated_at": "2026-01-18T14:36:26.275Z" }, "description_available": false, "entity_type": "Region", "id": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "is_inferred": false, "labels": [], "lang": "en", "name": "Asia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "location--68241bf7-96c8-5542-b488-3b8fe8f51aff", "type": "Region" }, { "__typename": "Sector", "aliases": [ "Defence", "National Security" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.390Z", "created_at": "2026-01-18T14:35:06.351Z", "modified": "2026-02-22T09:57:31.072Z", "updated_at": "2026-02-22T09:57:31.072Z" }, "description_available": true, "entity_type": "Sector", "id": "86dceb6c-5d18-4956-8792-cf2d15d37ae5", "is_inferred": false, "labels": [], "lang": "en", "name": "Defense", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "identity--a60aa444-a004-5549-9dcf-5798d82b34da", "type": "Sector" }, { "__typename": "Malware", "aliases": [ "win.stealc" ], "attributes": { "is_family": true, "malware_types": [ "bot" ] }, "authorized_members": [], "confidence": 50, "created_by": { "authorized_members": [], "id": "1b7caa41-88e1-4a38-8cfc-62b85639333a", "is_inferred": false, "name": "Malpedia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2026-01-18T17:45:20.693Z", "created_at": "2026-01-18T17:48:52.863Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-26T00:28:02.161Z", "updated_at": "2026-09-26T00:28:02.161Z" }, "description_available": true, "entity_type": "Malware", "id": "90740c7b-0969-4359-a452-1a4775ff4af2", "is_inferred": false, "labels": [ "botnet_cc", "c2", "stealc", "stealer", "triage" ], "lang": "en", "name": "Stealc", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "f5a9961b-77b3-45de-a111-97d904e86334", "source_name": "malpedia", "url": "https://any.run/cybersecurity-blog/crackedcantil-breakdown/" }, { "external_id": null, "id": "35682a3c-b40e-4b59-9530-eaa9813e91c7", "source_name": "malpedia", "url": "https://aviab1.github.io/blog/powershell-infection-2025/" }, { "external_id": null, "id": "e6333d7b-1be6-415e-a563-9f867aa64116", "source_name": "malpedia", "url": "https://blog.lexfo.fr/StealC_malware_analysis_part1.html" }, { "external_id": null, "id": "7e6c121d-f907-4a2d-b312-53f4e047908d", "source_name": "malpedia", "url": "https://blog.lexfo.fr/StealC_malware_analysis_part2.html" }, { "external_id": null, "id": "0d70d16e-edb3-436b-9813-53c9476fcfeb", "source_name": "malpedia", "url": "https://blog.lexfo.fr/StealC_malware_analysis_part3.html" }, { "external_id": null, "id": "3ed1cf4a-fbc2-40cf-97ec-7caac6d2a963", "source_name": "malpedia", "url": "https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/" }, { "external_id": null, "id": "9a37febd-b5f3-458b-bfd8-926837488dcc", "source_name": "malpedia", "url": "https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/" }, { "external_id": null, "id": "81fa604b-18e2-4b4d-a06f-743126fe13dd", "source_name": "malpedia", "url": "https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/" }, { "external_id": null, "id": "99bad49d-4e62-4044-be76-b6e5d6d2d095", "source_name": "malpedia", "url": "https://cocomelonc.github.io/book/2023/12/13/malwild-book.html" }, { "external_id": null, "id": "9b0e9b0f-0864-405e-b41c-5d8355036ef4", "source_name": "malpedia", "url": "https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af" }, { "external_id": null, "id": "0e5797e3-bc66-4cca-8bb5-39d18b27aec3", "source_name": "malpedia", "url": "https://github.com/Yavuzhanzgen/StealC-Malware-Analysis/blob/main/Reports/StealC-V2-EN.md" }, { "external_id": null, "id": "cf9ffed0-5c1b-4ddc-af39-1db2a4904296", "source_name": "malpedia", "url": "https://github.com/echocti/ECHO-Reports/blob/main/Malware%20Analysis%20Report/StealC/StealC_Technical_Analysis_Report.pdf" }, { "external_id": null, "id": "5967c615-2d6b-43af-92fe-7bf0ae5ac4e2", "source_name": "malpedia", "url": "https://github.com/muha2xmad/Python/blob/bdc7a711d5a775f8ae47b591f20fdd2e1360b77b/Stealc/stealc_config_extractor.ipynb" }, { "external_id": null, "id": "6cba1292-76d2-40b3-a0f0-762e57cff2f6", "source_name": "malpedia", "url": "https://github.com/muha2xmad/Python/blob/bdc7a711d5a775f8ae47b591f20fdd2e1360b77b/Stealc/stealc_string_decryption.py" }, { "external_id": null, "id": "4e9556e3-a80d-4bff-b7cd-65387d8f04f7", "source_name": "malpedia", "url": "https://glyc3rius.github.io/2023/10/stealc/" }, { "external_id": null, "id": "4e58a597-57fc-4b47-9b25-d235e23396a5", "source_name": "malpedia", "url": "https://hexastrike.com/resources/blog/threat-intelligence/cloned-loaded-and-stolen-how-109-fake-github-repositories-delivered-smartloader-and-stealc/" }, { "external_id": null, "id": "537b35df-0bc9-409f-836f-709dbccd2b1e", "source_name": "malpedia", "url": "https://hunt.io/blog/russian-speaking-actors-impersonate-etf-distribute-stealc-pyramid-c2" }, { "external_id": null, "id": "f2474ac9-4f53-465f-91da-481f5f40d74e", "source_name": "malpedia", "url": "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf" }, { "external_id": null, "id": "c2e6e0bc-58d3-406d-a03e-8704a37b8131", "source_name": "malpedia", "url": "https://info.spamhaus.com/hubfs/Botnet%20Reports/Jul-Dec%202024%20Botnet%20Threat%20Update.pdf" }, { "external_id": null, "id": "2bac09fb-6a63-4615-9eca-89d55c858862", "source_name": "malpedia", "url": "https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc" }, { "external_id": null, "id": "fe45695a-5f37-4e01-b06a-6128a8133729", "source_name": "malpedia", "url": "https://maxchertin.github.io/posts/stealc-v2/" }, { "external_id": null, "id": "f87d431b-faa2-4fac-805c-9a8113ed6410", "source_name": "malpedia", "url": "https://securelist.com/tusk-infostealers-campaign/113367/" }, { "external_id": null, "id": "e495cc32-c4f0-4207-998a-d23fdefa5d46", "source_name": "malpedia", "url": "https://trac-labs.com/autopsy-of-a-failed-stealer-stealc-v2-a4e32da04396" }, { "external_id": null, "id": "ff793527-0486-4446-bf0b-5b6fba3d8d8f", "source_name": "malpedia", "url": "https://www.bitsight.com/blog/bitsight-aids-disruption-efforts-on-amadey-malware-and-stealc-malware" }, { "external_id": null, "id": "e87c6fee-2b0a-4d3a-88ca-d67bafb7ed27", "source_name": "malpedia", "url": "https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware" }, { "external_id": null, "id": "3f8eab23-98d8-44f6-ab80-1044b038afe9", "source_name": "malpedia", "url": "https://www.cyberark.com/resources/threat-research-blog/uno-reverse-card-stealing-cookies-from-cookie-stealers" }, { "external_id": null, "id": "bb358876-404a-436f-9d62-f2c1493132be", "source_name": "malpedia", "url": "https://www.esentire.com/blog/mintsloader-stealc-and-boinc-delivery" }, { "external_id": null, "id": "02545180-ca26-4161-ab98-725f8a7d3c3e", "source_name": "malpedia", "url": "https://www.esentire.com/blog/stealc-delivered-via-deceptive-google-sheets" }, { "external_id": null, "id": "9a3dac38-e173-448f-a263-e12d5ff05442", "source_name": "malpedia", "url": "https://www.europol.europa.eu/media-press/newsroom/news/global-cyber-strike-disrupts-socgholish-amadey-and-stealc-malware-networks" }, { "external_id": null, "id": "13e52a13-d02f-47c7-81f2-5338ce60352c", "source_name": "malpedia", "url": "https://www.levelblue.com/blogs/spiderlabs-blog/how-clickfix-opens-the-door-to-stealthy-stealc-information-stealer" }, { "external_id": null, "id": "de79f291-cce2-42c5-8f1b-b07f18a9a690", "source_name": "malpedia", "url": "https://www.recordedfuture.com/research/uncovering-mintsloader-with-recorded-future-malware-intelligence-hunting" }, { "external_id": null, "id": "ec042f45-fcfd-4852-8a9f-d43af6a782e9", "source_name": "malpedia", "url": "https://www.recordedfuture.com/the-travels-of-markopolo-self-proclaimed-meeting-software-vortax-spreads-infostealers" }, { "external_id": null, "id": "79529efc-5818-4c8b-8e91-fbd73997c62d", "source_name": "malpedia", "url": "https://www.trendmicro.com/en_us/research/25/c/deep-dive-into-water-gamayun.html" }, { "external_id": null, "id": "1c3915de-b531-4093-808a-6375e9e610c3", "source_name": "malpedia", "url": "https://www.trendmicro.com/en_us/research/25/e/tiktok-videos-infostealers.html" }, { "external_id": null, "id": "5cf85b6c-ec26-4a84-a8c8-e823051c1add", "source_name": "malpedia", "url": "https://www.vmray.com/cyber-security-blog/stealc-a-new-stealer-emerges-in-2023/" }, { "external_id": null, "id": "ba34331d-11da-4b35-b643-8a7f9f4ce5d8", "source_name": "malpedia", "url": "https://www.zscaler.com/blogs/security-research/i-stealc-you-tracking-rapid-changes-stealc" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "malware--704d28eb-903d-5974-bbf3-2f5f4d775a8f", "type": "Malware" }, { "__typename": "Country", "aliases": [ "NL", "NLD" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.062Z", "created_at": "2026-01-18T14:36:55.605Z", "modified": "2026-01-25T16:23:12.672Z", "updated_at": "2026-01-25T16:23:12.672Z" }, "description_available": false, "entity_type": "Country", "id": "9ebd9843-38da-417d-8c94-c4c6e1ef07af", "is_inferred": false, "labels": [], "lang": "en", "name": "Netherlands", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "location--5bb85183-8229-549f-a7ed-2630c10c453d", "type": "Country" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:33:29.878Z", "updated_at": "2026-09-25T22:33:31.291Z" }, "description_available": false, "entity_type": "StixFile", "id": "a4a737cc-ac86-4db1-818b-92472abb1cf0", "is_inferred": false, "labels": [ "applescript", "clickfix", "credential theft", "cryptocurrency wallets", "lummac2", "maas", "macos stealer", "macsync", "obfuscation", "social engineering", "stealc", "vidar" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "file--6a7e6992-ce57-5151-bfe3-4da39b0bbe6d", "type": "StixFile" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:33:34.967Z", "updated_at": "2026-09-25T22:33:35.778Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "a78caabb-ebf9-4413-9c79-523aab1ab535", "is_inferred": false, "labels": [ "applescript", "clickfix", "credential theft", "cryptocurrency wallets", "lummac2", "maas", "macos stealer", "macsync", "obfuscation", "social engineering", "stealc", "vidar" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "domain-name--5d948867-36ff-5f47-9bda-f0c923331aae", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.217Z", "created_at": "2026-09-25T22:33:42.500Z", "modified": "2026-09-25T22:33:56.557Z", "updated_at": "2026-09-25T22:33:56.557Z" }, "description_available": false, "entity_type": "Indicator", "id": "ac3fae9c-f9c3-44bf-9e7c-14f92e81e1cd", "is_inferred": false, "labels": [ "applescript", "clickfix", "credential theft", "cryptocurrency wallets", "lummac2", "maas", "macos stealer", "macsync", "obfuscation", "social engineering", "stealc", "vidar" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "indicator--20aa9e91-8044-5fc2-8671-77b262950e18", "type": "Indicator" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:36.999Z", "created_at": "2026-01-18T14:35:39.076Z", "modified": "2026-01-18T14:35:40.483Z", "updated_at": "2026-01-18T14:35:40.483Z" }, "description_available": false, "entity_type": "Region", "id": "b3cffd93-96e8-4612-9ed8-1236cbd3025c", "is_inferred": false, "labels": [], "lang": "en", "name": "Africa", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "location--7e13827c-720f-5725-978b-907dc66a6f6f", "type": "Region" }, { "__typename": "Malware", "aliases": [ "osx.macsync" ], "attributes": { "is_family": true, "malware_types": [ "bot" ] }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-29T10:33:57.399Z", "created_at": "2026-04-20T00:06:21.769Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-10-07T03:13:51.397Z", "updated_at": "2026-10-07T03:13:51.397Z" }, "description_available": true, "entity_type": "Malware", "id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "is_inferred": false, "labels": [ "botnet_cc", "none" ], "lang": "en", "name": "MacSync", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "0a621f5c-e1a1-4100-8de9-bdd7bc958d9f", "source_name": "malpedia", "url": "https://malpedia.caad.fkie.fraunhofer.de/details/osx.macsync" }, { "external_id": null, "id": "6e20f7d0-5961-4588-bfaa-c9df2ac070ce", "source_name": "malpedia", "url": "https://www.zscaler.com/blogs/security-research/claudefix-shared-claude-chats-meet-clickfix" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "malware--3055d3cf-d404-5a90-a259-35ebce857521", "type": "Malware" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.041Z", "created_at": "2026-01-18T14:36:30.055Z", "modified": "2026-01-18T14:36:30.331Z", "updated_at": "2026-01-18T14:36:30.331Z" }, "description_available": false, "entity_type": "Region", "id": "c0c50eda-edd8-4175-a851-a0bb39fc00cb", "is_inferred": false, "labels": [], "lang": "en", "name": "South-eastern Asia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "location--f2bd521a-b95b-5f99-897b-872ba66060b3", "type": "Region" }, { "__typename": "Country", "aliases": [ "DE", "DEU" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.061Z", "created_at": "2026-01-18T14:36:54.657Z", "modified": "2026-01-25T15:49:18.680Z", "updated_at": "2026-01-25T15:49:18.680Z" }, "description_available": false, "entity_type": "Country", "id": "c31973cc-3fba-4e06-8ae7-41954e92d90f", "is_inferred": false, "labels": [], "lang": "en", "name": "Germany", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "location--7215cb31-5700-55b2-81b3-633c09c0351d", "type": "Country" }, { "__typename": "Malware", "aliases": [ "win.vidar" ], "attributes": { "is_family": false, "malware_types": [ "bot" ] }, "authorized_members": [], "confidence": 50, "created_by": { "authorized_members": [], "id": "1b7caa41-88e1-4a38-8cfc-62b85639333a", "is_inferred": false, "name": "Malpedia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2026-01-18T19:55:22.473Z", "created_at": "2026-01-19T02:35:26.049Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-10-09T09:24:18.779Z", "updated_at": "2026-10-09T09:24:18.779Z" }, "description_available": true, "entity_type": "Malware", "id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "is_inferred": false, "labels": [ "none", "payload" ], "lang": "en", "name": "Vidar", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "b07168f5-8437-4277-8a54-c9b0684243e8", "source_name": "CISA Scattered Spider Advisory November 2023", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a" }, { "external_id": null, "id": "fdc366e9-5d5c-4df6-bf9a-e88e5fe2c97a", "source_name": "Crowdstrike GTR2020 Mar 2020", "url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf" }, { "external_id": null, "id": "a3a42365-4ea0-4d07-82fc-d8c82cfae72c", "source_name": "Google Cloud Threat Intelligence UNC5537 Snowflake 2024", "url": "https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion" }, { "external_id": null, "id": "27e6d3ed-714e-413d-b0a6-1349a7a7d09b", "source_name": "SecureWorks Infostealers 2023", "url": "https://www.secureworks.com/research/the-growing-threat-from-infostealers" }, { "external_id": null, "id": "315614d7-7c65-4419-a167-40bb4db07b85", "source_name": "ThreatFox source reference", "url": "https://www.netskope.com/jp/blog/openclaw-hologram-fake-installer-ships-rust-infostealer" }, { "external_id": null, "id": "4d3b593a-fcd6-4e4b-acba-dc408fcddff7", "source_name": "alien-vault", "url": "https://www.microsoft.com/en-us/security/blog/2026/05/19/exposing-fox-tempest-a-malware-signing-service-operation/" }, { "external_id": null, "id": "161f170f-63e6-44eb-b6f8-7c0cf4b17c97", "source_name": "alien-vault", "url": "https://www.netskope.com/blog/100k-in-crypto-drained-by-the-underground-operation" }, { "external_id": null, "id": "ce02fb10-84f3-492c-9e33-56b2c8dd3e27", "source_name": "alien-vault", "url": "https://www.zscaler.com/blogs/security-research/2cloader-new-malware-loader-delivering-vidar-and-remus" }, { "external_id": null, "id": "c18f8042-10bc-41a5-abfd-f63080e34db5", "source_name": "alien-vault", "url": "https://www.zscaler.com/blogs/security-research/anthropic-claude-code-leak" }, { "external_id": null, "id": "a79f9cc2-2aba-4526-a227-7f4eb96744c2", "source_name": "malpedia", "url": "https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/" }, { "external_id": null, "id": "b5ce39c9-b188-4d8c-a19f-c6e01bd3f50f", "source_name": "malpedia", "url": "https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/" }, { "external_id": null, "id": "0636d89a-e1ae-4fe0-b613-f7f10fcf360d", "source_name": "malpedia", "url": "https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign" }, { "external_id": null, "id": "ab97bac8-5bea-4d1c-9402-5d566be242f3", "source_name": "malpedia", "url": "https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/" }, { "external_id": null, "id": "7620bd6e-959f-47c9-8383-b14412fdb3ed", "source_name": "malpedia", "url": "https://asec.ahnlab.com/en/22932/" }, { "external_id": null, "id": "74501a51-5a3f-4ab5-81aa-1af41dfc2a61", "source_name": "malpedia", "url": "https://asec.ahnlab.com/en/30445/" }, { "external_id": null, "id": "1ea065cd-3334-4f40-865f-37f8c7250eb2", "source_name": "malpedia", "url": "https://asec.ahnlab.com/en/30875/" }, { "external_id": null, "id": "ebdc2405-ff27-42a8-87d1-b4002ff0da87", "source_name": "malpedia", "url": "https://asec.ahnlab.com/ko/25837/" }, { "external_id": null, "id": "c40f38b9-28ed-483b-8728-b60834377d6a", "source_name": "malpedia", "url": "https://aviab1.github.io/Vidar-Stealer/" }, { "external_id": null, "id": "882a4b2e-61ed-4c20-b475-6fd3b8cf1170", "source_name": "malpedia", "url": "https://aviab1.github.io/blog/vidar-stealer/" }, { "external_id": null, "id": "25d4aa54-82c9-4f86-9ab1-8866c603fdae", "source_name": "malpedia", "url": "https://blog.cyble.com/2022/11/08/massive-youtube-campaign-targeting-over-100-applications-to-deliver-info-stealer/" }, { "external_id": null, "id": "4b04e91f-69ed-4ee6-92ee-2870c0b24b7a", "source_name": "malpedia", "url": "https://blog.jaalma.io/vidar-infostealer-analysis/" }, { "external_id": null, "id": "f37f9192-a65d-4c0a-aad2-8c675db1abe2", "source_name": "malpedia", "url": "https://blog.malwarebytes.com/threat-analysis/2019/01/vidar-gandcrab-stealer-and-ransomware-combo-observed-in-the-wild/" }, { "external_id": null, "id": "e01a3ae4-657d-49f1-a294-5645264c1971", "source_name": "malpedia", "url": "https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/" }, { "external_id": null, "id": "30e6b853-b8a0-41d0-84c7-ad5f2018a2f4", "source_name": "malpedia", "url": "https://blog.minerva-labs.com/vidar-stealer-evasion-arsenal" }, { "external_id": null, "id": "3a386a0a-a61e-4840-8d91-1d7aafce6263", "source_name": "malpedia", "url": "https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/" }, { "external_id": null, "id": "548d2d9d-84e8-4a6d-a7b5-4093b981f5c5", "source_name": "malpedia", "url": "https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/" }, { "external_id": null, "id": "f8789f76-36ac-4de1-9982-f650f7ebe48b", "source_name": "malpedia", "url": "https://blog.sekoia.io/traffers-a-deep-dive-into-the-information-stealer-ecosystem" }, { "external_id": null, "id": "c756766b-ffa8-4da4-bae0-3e196186546b", "source_name": "malpedia", "url": "https://blogs.microsoft.com/on-the-issues/2026/05/19/disrupting-fox-tempest-a-cybercrime-service/" }, { "external_id": null, "id": "39008d19-95d9-4736-a3ab-6408be474770", "source_name": "malpedia", "url": "https://bluecyber.hashnode.dev/analysis-of-a-clickfix-malware-attack" }, { "external_id": null, "id": "9163fb68-2725-42ad-a2f3-9ee6c3897fc2", "source_name": "malpedia", "url": "https://censys.com/a-beginners-guide-to-hunting-open-directories/" }, { "external_id": null, "id": "3de11371-3ec9-4dbe-b23c-3ab3fb1d9ab0", "source_name": "malpedia", "url": "https://censys.com/tracking-vidar-infrastructure/" }, { "external_id": null, "id": "00de0b28-9da7-44d3-b20a-f0c6bc4062fd", "source_name": "malpedia", "url": "https://cert.pl/en/posts/2021/10/vidar-campaign/" }, { "external_id": null, "id": "2ae1aaed-34f7-4a1d-8c8d-34453d77013b", "source_name": "malpedia", "url": "https://community.emergingthreats.net/t/vidar-stealer-picks-up-steam/271" }, { "external_id": null, "id": "2022b586-d094-4c2f-8dc2-bc3fc1fc2303", "source_name": "malpedia", "url": "https://darktrace.com/blog/vidar-info-stealer-malware-distributed-via-malvertising-on-google" }, { "external_id": null, "id": "e5c2a3cf-9444-49ee-a39d-7edf95f2e567", "source_name": "malpedia", "url": "https://docs.google.com/spreadsheets/d/1nx42rdMdkCrvlmACDi3CHseyG87iSV1Y6rGZYq_-oDk" }, { "external_id": null, "id": "3e140f7e-7832-45f8-9303-fed8a0be9c7d", "source_name": "malpedia", "url": "https://eln0ty.github.io/malware%20analysis/vidar/" }, { "external_id": null, "id": "41c270fd-fdea-4e41-bccc-592f6d03d029", "source_name": "malpedia", "url": "https://embee-research.ghost.io/ghidra-basics-identifying-and-decoding-encrypted-strings/" }, { "external_id": null, "id": "eec510f9-1d6a-4161-a5b6-4230aaea09ee", "source_name": "malpedia", "url": "https://fumik0.com/2018/12/24/lets-dig-into-vidar-an-arkei-copycat-forked-stealer-in-depth-analysis/" }, { "external_id": null, "id": "cd7046ef-4682-40f8-9303-02af670db56e", "source_name": "malpedia", "url": "https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-vidar-2c0a62a73087" }, { "external_id": null, "id": "cc815ae2-b2c9-4f83-90f1-b7da62776dcb", "source_name": "malpedia", "url": "https://go.recordedfuture.com/hubfs/reports/cta-2022-0802.pdf" }, { "external_id": null, "id": "a3d1e275-49f9-4c17-bb2e-4a5a29bff402", "source_name": "malpedia", "url": "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf" }, { "external_id": null, "id": "f2474ac9-4f53-465f-91da-481f5f40d74e", "source_name": "malpedia", "url": "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf" }, { "external_id": null, "id": "45cc5f0d-297f-4ea5-9a23-b0840be23a23", "source_name": "malpedia", "url": "https://insights.loaderinsight.agency/posts/vidar-build-id-correlation/" }, { "external_id": null, "id": "4ad0988b-8644-42e1-973b-fb6ca298277f", "source_name": "malpedia", "url": "https://intel471.com/blog/privateloader-malware" }, { "external_id": null, "id": "1721fa81-5f88-4f65-bfd2-1c146f74ae36", "source_name": "malpedia", "url": "https://isc.sans.edu/diary/Arkei+Variants%3A+From+Vidar+to+Mars+Stealer/28468" }, { "external_id": null, "id": "6ab5165a-b028-49ca-9beb-adf794aef6b7", "source_name": "malpedia", "url": "https://isc.sans.edu/diary/rss/28468" }, { "external_id": null, "id": "d20a0fbb-e7b3-44cf-9a33-d733d87af3e5", "source_name": "malpedia", "url": "https://ke-la.com/information-stealers-a-new-landscape/" }, { "external_id": null, "id": "651c601f-90ba-4f7c-885b-e9dbbc695436", "source_name": "malpedia", "url": "https://kienmanowar.wordpress.com/2022/12/17/quicknote-vidarstealer-analysis/" }, { "external_id": null, "id": "5d20e3ed-cd26-446d-a352-d18cee48c6e0", "source_name": "malpedia", "url": "https://m4lcode.github.io/malware%20analysis/vidar/" }, { "external_id": null, "id": "9a321d90-7223-4556-afa2-c3d7c26dfdee", "source_name": "malpedia", "url": "https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar" }, { "external_id": null, "id": "3f18b077-9a47-478b-8c14-c6e78239042e", "source_name": "malpedia", "url": "https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145" }, { "external_id": null, "id": "40852be7-93a6-4071-b802-ea81ffcbabd7", "source_name": "malpedia", "url": "https://medium.com/s2wlab/deep-analysis-of-vidar-stealer-ebfc3b557aed" }, { "external_id": null, "id": "f87098ea-982e-4ca3-91ff-a85acccd6b1e", "source_name": "malpedia", "url": "https://medium.com/s2wlab/w1-feb-en-story-of-the-week-stealers-on-the-darkweb-49945a31601d" }, { "external_id": null, "id": "ff6d34bd-9f69-4f64-803a-edf92e77c59a", "source_name": "malpedia", "url": "https://mrtiepolo.medium.com/operation-turb00-analyzing-and-hunting-a-vidar-campaign-b45481d8cd74" }, { "external_id": null, "id": "88962bed-f49a-4cc0-84ea-5a468d434674", "source_name": "malpedia", "url": "https://research.checkpoint.com/2022/bumblebee-increasing-its-capacity-and-evolving-its-ttps/" }, { "external_id": null, "id": "37052f99-f620-4f03-9522-299e4addcf20", "source_name": "malpedia", "url": "https://securelist.com/nullmixer-oodles-of-trojans-in-a-single-dropper/107498/" }, { "external_id": null, "id": "f702625e-9cff-4fd3-ba4e-9fde402d4f1f", "source_name": "malpedia", "url": "https://socprime.com/blog/somnia-malware-detection-uac-0118-aka-frwl-launches-cyber-attacks-against-organizations-in-ukraine-using-enhanced-malware-strains/" }, { "external_id": null, "id": "51f93c5a-018f-44e5-9f4b-2655929acdd6", "source_name": "malpedia", "url": "https://tccontre.blogspot.com/2019/03/infor-stealer-vidar-trojanspy-analysis.html" }, { "external_id": null, "id": "436e87a6-ae77-4932-8cad-53b5c3781f4c", "source_name": "malpedia", "url": "https://therecord.media/microsoft-disrupts-fox-tempest-malware-signing-service" }, { "external_id": null, "id": "599fed37-d621-4b4e-80ea-f873b62dcb22", "source_name": "malpedia", "url": "https://threatpost.com/microsoft-help-files-vidar-malware/179078/" }, { "external_id": null, "id": "c09edf0b-a523-45b0-b3eb-aa5685db8db2", "source_name": "malpedia", "url": "https://twitter.com/GroupIB_GIB/status/1570821174736850945" }, { "external_id": null, "id": "1c4671d7-f555-4c4b-9518-f8dc84c12d79", "source_name": "malpedia", "url": "https://twitter.com/sisoma2/status/1409816282065743872" }, { "external_id": null, "id": "28e9cc9b-7162-46c4-8fc2-b217af969b91", "source_name": "malpedia", "url": "https://viuleeenz.github.io/posts/2023/10/vidar-payload-inspection-with-static-analysis/" }, { "external_id": null, "id": "fdd5b398-dd30-4b4a-8a37-d72fa7fd5259", "source_name": "malpedia", "url": "https://www.aryaka.com/docs/reports/vidar-infostealer-in-action.pdf" }, { "external_id": null, "id": "b7f61ecd-f15f-4b86-b0a4-430a3d63d509", "source_name": "malpedia", "url": "https://www.bleepingcomputer.com/news/security/fake-pixelmon-nft-site-infects-you-with-password-stealing-malware/" }, { "external_id": null, "id": "eb53b48c-85bb-4da8-a13f-6be517163fed", "source_name": "malpedia", "url": "https://www.bleepingcomputer.com/news/security/gandcrab-operators-use-vidar-infostealer-as-a-forerunner/" }, { "external_id": null, "id": "144a11f1-092e-4ea9-a743-75eb0007a2af", "source_name": "malpedia", "url": "https://www.cisa.gov/sites/default/files/2023-11/aa23-320a_scattered_spider.pdf" }, { "external_id": null, "id": "e87c6fee-2b0a-4d3a-88ca-d67bafb7ed27", "source_name": "malpedia", "url": "https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware" }, { "external_id": null, "id": "b19787e9-2200-4f14-9844-e3622b90c19b", "source_name": "malpedia", "url": "https://www.csoonline.com/article/3654849/microsoft-help-files-repurposed-to-contain-vidar-malware-in-new-campaign.html" }, { "external_id": null, "id": "8d96a3c6-3b3d-4465-a166-0081f5d49646", "source_name": "malpedia", "url": "https://www.cybereason.com/blog/the-hole-in-the-bucket-attackers-abuse-bitbucket-to-deliver-an-arsenal-of-malware" }, { "external_id": null, "id": "31f78e34-0cba-4b4d-bce0-934b4688f9a5", "source_name": "malpedia", "url": "https://www.cynet.com/blog/cyops-lighthouse-vidar-stealer/" }, { "external_id": null, "id": "adf1ff42-2277-4c05-9f78-d494d454d2fc", "source_name": "malpedia", "url": "https://www.derp.ca/research/vidar-go-sandbox-dead-drop/" }, { "external_id": null, "id": "7812be83-4306-4338-add7-17d21fe13f90", "source_name": "malpedia", "url": "https://www.elastic.co/security-labs/ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks" }, { "external_id": null, "id": "80a643a1-b36d-4794-89ef-f6dc0ad08d3d", "source_name": "malpedia", "url": "https://www.esentire.com/blog/batloader-continues-to-abuse-google-search-ads-to-deliver-vidar-stealer-and-ursnif" }, { "external_id": null, "id": "67cf60d1-24de-4e6e-8b06-a14c3ac2dc6b", "source_name": "malpedia", "url": "https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-batloader" }, { "external_id": null, "id": "5937af53-7bcd-4b12-8caf-65d031c525af", "source_name": "malpedia", "url": "https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-vidar-stealer" }, { "external_id": null, "id": "f0776771-b7ac-40d9-a2fb-dc35b049a195", "source_name": "malpedia", "url": "https://www.fortinet.com/blog/threat-research/the-year-of-the-wiper" }, { "external_id": null, "id": "9a123075-ec9d-4bbf-85d6-c6f2b956baec", "source_name": "malpedia", "url": "https://www.gatewatcher.com/lab/utilisation-de-faux-profils-steam-vidar-prend-les-commandes/" }, { "external_id": null, "id": "2166b1bf-fd3f-4c82-a780-9b1ff92bdc13", "source_name": "malpedia", "url": "https://www.gendigital.com/blog/insights/research/inside-vidar-abe-bypass" }, { "external_id": null, "id": "07f17402-3042-46aa-bca5-fb9c5e1b197d", "source_name": "malpedia", "url": "https://www.huntress.com/blog/openclaw-github-ghostsocks-infostealer" }, { "external_id": null, "id": "016447cd-3bd9-4743-ba97-c2e1fe1968d0", "source_name": "malpedia", "url": "https://www.kroll.com/en/insights/publications/cyber/threat-actors-google-ads-deploy-vidar-stealer" }, { "external_id": null, "id": "2510035d-f8c2-41fc-8f87-10bdb1bb66df", "source_name": "malpedia", "url": "https://www.logpoint.com/wp-content/uploads/2024/03/logpoint-etpr-a-comprehensive-overview-on-stealer-malware-families.pdf" }, { "external_id": null, "id": "1e5f05bb-9433-410d-a9b3-4bfbb4456c5c", "source_name": "malpedia", "url": "https://www.quorumcyber.com/wp-content/uploads/2023/01/Malware-Analysis-Vidar.pdf" }, { "external_id": null, "id": "32da9166-004f-4b67-824a-b7bd88d6389e", "source_name": "malpedia", "url": "https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-july-to-december-2025/" }, { "external_id": null, "id": "30391646-1f3d-4dbc-80d2-eb785b9ee705", "source_name": "malpedia", "url": "https://www.team-cymru.com/post/darth-vidar-the-aesir-strike-back" }, { "external_id": null, "id": "f298c706-5815-4e7b-b43a-14d03c673117", "source_name": "malpedia", "url": "https://www.team-cymru.com/post/darth-vidar-the-dark-side-of-evolving-threat-infrastructure" }, { "external_id": null, "id": "ce6bac6d-df0e-46a7-a904-110fa0be1ddc", "source_name": "malpedia", "url": "https://www.trendmicro.com/en_us/research/21/i/fake-installers-drop-malware-and-open-doors-for-opportunistic-attackers.html" }, { "external_id": null, "id": "1c3915de-b531-4093-808a-6375e9e610c3", "source_name": "malpedia", "url": "https://www.trendmicro.com/en_us/research/25/e/tiktok-videos-infostealers.html" }, { "external_id": null, "id": "22c0e0b7-f2de-4f07-bcd7-0097042715d6", "source_name": "malpedia", "url": "https://www.trendmicro.com/en_us/research/25/j/how-vidar-stealer-2-upgrades-infostealer-capabilities.html" }, { "external_id": null, "id": "867cc050-4804-4c9d-b78d-12dc8af83e0e", "source_name": "malpedia", "url": "https://www.trendmicro.com/en_us/research/26/d/weaponizing-trust-claude-code-lures-and-github-release-payloads.html" }, { "external_id": null, "id": "e14c0692-55e1-4b8e-99a9-050b3d1598fa", "source_name": "malpedia", "url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/vidar-malware-launcher-concealed-in-help-file/" }, { "external_id": null, "id": "9bb7bd95-75d4-41f7-9861-c65b553f24d4", "source_name": "malpedia", "url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation" }, { "external_id": null, "id": "3a79d954-536f-42ea-ba34-9453a5d4dcc5", "source_name": "malpedia", "url": "https://www.zscaler.com/blogs/security-research/vidar-distributed-through-backdoored-windows-11-downloads-and-abusing" }, { "external_id": null, "id": "f23130ab-88c4-407b-843e-9ef2b0cf7fc6", "source_name": "malpedia", "url": "https://xer0xe9.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/" }, { "external_id": null, "id": "adbe0b48-4d08-42c2-af25-a3943badf5c2", "source_name": "malpedia", "url": "https://xer0xe9.github.io/A-Case-of-Vidar-Infostealer-Part-2/" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "malware--7411d5ab-6535-5874-b5e2-43fe642028a5", "type": "Malware" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.052Z", "created_at": "2026-01-18T14:36:45.082Z", "modified": "2026-01-18T14:36:45.471Z", "updated_at": "2026-01-18T14:36:45.471Z" }, "description_available": false, "entity_type": "Region", "id": "d5563518-7ebb-46ed-a037-525564906cd9", "is_inferred": false, "labels": [], "lang": "en", "name": "Northern Europe", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "location--47a439b0-ad3d-5a9e-8f6a-5de5a7e76d0b", "type": "Region" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:33:29.851Z", "updated_at": "2026-09-25T22:33:31.292Z" }, "description_available": false, "entity_type": "StixFile", "id": "da664471-b741-4ff7-954a-0dca535eae08", "is_inferred": false, "labels": [ "applescript", "clickfix", "credential theft", "cryptocurrency wallets", "lummac2", "maas", "macos stealer", "macsync", "obfuscation", "social engineering", "stealc", "vidar" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "file--d42177c2-6c63-5cbc-82d5-f54be1560b8f", "type": "StixFile" }, { "__typename": "Sector", "aliases": [ "Election", "Government", "Voting" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.392Z", "created_at": "2026-01-18T14:35:09.055Z", "modified": "2026-01-22T08:00:46.641Z", "updated_at": "2026-01-22T08:00:46.641Z" }, "description_available": true, "entity_type": "Sector", "id": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "is_inferred": false, "labels": [], "lang": "en", "name": "Government and administrations", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "identity--9d697b63-6ae0-5ddb-ae26-e3d6e03302e1", "type": "Sector" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.222Z", "created_at": "2026-09-25T22:33:43.302Z", "modified": "2026-09-25T22:33:59.924Z", "updated_at": "2026-09-25T22:33:59.924Z" }, "description_available": false, "entity_type": "Indicator", "id": "ef94c79b-d454-4cb3-bf81-7da9cdc5ef8e", "is_inferred": false, "labels": [ "applescript", "clickfix", "credential theft", "cryptocurrency wallets", "lummac2", "maas", "macos stealer", "macsync", "obfuscation", "social engineering", "stealc", "vidar" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "indicator--1b5bb949-c71d-5b51-8e7f-42db580611a7", "type": "Indicator" }, { "__typename": "Country", "aliases": [ "GB", "GBR" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.057Z", "created_at": "2026-01-18T14:36:49.586Z", "modified": "2026-01-21T04:27:12.575Z", "updated_at": "2026-01-21T04:27:12.575Z" }, "description_available": false, "entity_type": "Country", "id": "f2fc791f-b777-4d8f-87a6-5e87abeec776", "is_inferred": false, "labels": [], "lang": "en", "name": "United Kingdom of Great Britain and Northern Ireland", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "location--66421b20-2d5d-5586-8703-48da4d727028", "type": "Country" }, { "__typename": "Country", "aliases": [ "IO", "IOT" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.001Z", "created_at": "2026-01-18T14:35:46.139Z", "modified": "2026-03-05T15:26:02.116Z", "updated_at": "2026-03-05T15:26:02.116Z" }, "description_available": false, "entity_type": "Country", "id": "f571f0ef-816b-43b9-98be-7dd1ec907646", "is_inferred": false, "labels": [], "lang": "en", "name": "British Indian Ocean Territory", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "location--0d38b30d-6a67-566c-a32f-bbb91751d7d8", "type": "Country" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:23:20.378Z", "created_at": "2026-08-09T15:06:28.383Z", "modified": "2026-09-25T22:33:39.397Z", "updated_at": "2026-09-25T22:33:39.397Z" }, "description_available": false, "entity_type": "Indicator", "id": "f70940b5-5820-41e9-ae9b-5932d562dda4", "is_inferred": false, "labels": [ "applescript", "claude platform abuse", "clickfix", "credential stealing", "credential theft", "cryptocurrency theft", "cryptocurrency wallets", "lummac2", "maas", "macos stealer", "macos targeting", "macsync", "macsync stealer", "malvertising", "obfuscation", "shared chat abuse", "social engineering", "stealc", "vidar" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "indicator--51c637df-af5d-5d3a-bc1c-8af95b11dada", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:33:33.231Z", "updated_at": "2026-09-25T22:33:34.557Z" }, "description_available": false, "entity_type": "StixFile", "id": "f7c4d4ae-ca64-4c26-8f3e-236e5f24c9a1", "is_inferred": false, "labels": [ "applescript", "clickfix", "credential theft", "cryptocurrency wallets", "lummac2", "maas", "macos stealer", "macsync", "obfuscation", "social engineering", "stealc", "vidar" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "file--cffd0143-45c9-5d26-a2cc-e91e71e5dd3d", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:33:32.210Z", "updated_at": "2026-09-25T22:33:32.726Z" }, "description_available": false, "entity_type": "StixFile", "id": "f9a660d3-db90-4a47-868e-7c12473af38e", "is_inferred": false, "labels": [ "applescript", "clickfix", "credential theft", "cryptocurrency wallets", "lummac2", "maas", "macos stealer", "macsync", "obfuscation", "social engineering", "stealc", "vidar" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "file--4625feab-9412-5b96-9b20-a1a151fd5937", "type": "StixFile" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.319Z", "created_at": "2026-09-25T22:38:28.230Z", "modified": "2026-09-25T22:38:28.797Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:38:28.797Z" }, "description_available": false, "entity_type": "indicates", "fromId": "05249b1e-20c2-4d0c-8b6b-042029a7e4e6", "from_id": "05249b1e-20c2-4d0c-8b6b-042029a7e4e6", "from_name": null, "from_type": "Indicator", "id": "0701056e-702a-486c-a60a-be22778eeca8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--34874836-fd6f-5e4e-9e7f-d90450c46dd1", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.332Z", "created_at": "2026-09-25T22:38:43.810Z", "modified": "2026-09-25T22:38:44.000Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:38:44.000Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ef94c79b-d454-4cb3-bf81-7da9cdc5ef8e", "from_id": "ef94c79b-d454-4cb3-bf81-7da9cdc5ef8e", "from_name": null, "from_type": "Indicator", "id": "09927e0d-91b3-4e68-bd63-bf8d89b0e301", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--8de0e6db-a344-5afb-8a9c-713d3155267d", "toId": "90740c7b-0969-4359-a452-1a4775ff4af2", "to_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "to_name": "Stealc", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.221Z", "created_at": "2026-09-25T22:36:15.531Z", "modified": "2026-09-25T22:36:17.758Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:36:17.758Z" }, "description_available": false, "entity_type": "based-on", "fromId": "05249b1e-20c2-4d0c-8b6b-042029a7e4e6", "from_id": "05249b1e-20c2-4d0c-8b6b-042029a7e4e6", "from_name": null, "from_type": "Indicator", "id": "09d4b7c6-9a29-4ac7-a4b5-782ac73ef19f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--901eda78-f755-57d3-ba98-301ecb8878c2", "toId": "a78caabb-ebf9-4413-9c79-523aab1ab535", "to_id": "a78caabb-ebf9-4413-9c79-523aab1ab535", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.309Z", "created_at": "2026-09-25T22:38:17.526Z", "modified": "2026-09-25T22:38:17.787Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:38:17.787Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ac3fae9c-f9c3-44bf-9e7c-14f92e81e1cd", "from_id": "ac3fae9c-f9c3-44bf-9e7c-14f92e81e1cd", "from_name": null, "from_type": "Indicator", "id": "09d7c6a0-c066-4015-a558-0f937f9627b4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--b78f0f9d-6095-5653-a07b-df05828ed5cf", "toId": "90740c7b-0969-4359-a452-1a4775ff4af2", "to_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "to_name": "Stealc", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.189Z", "created_at": "2026-09-25T22:34:12.821Z", "modified": "2026-09-25T22:34:13.189Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:34:13.189Z" }, "description_available": false, "entity_type": "targets", "fromId": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_name": "Stealc", "from_type": "Malware", "id": "113ac537-15d2-43e0-97c5-6286ef148e0d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--9e9106c3-8a8f-509b-87a3-10db1174ed46", "toId": "6926835d-28e0-4787-97c9-699d0375b12b", "to_id": "6926835d-28e0-4787-97c9-699d0375b12b", "to_name": "India", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.274Z", "created_at": "2026-09-25T22:37:34.598Z", "modified": "2026-09-25T22:37:34.811Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:37:34.811Z" }, "description_available": false, "entity_type": "indicates", "fromId": "24fc8125-aab7-470f-97fd-f7d447ba5095", "from_id": "24fc8125-aab7-470f-97fd-f7d447ba5095", "from_name": null, "from_type": "Indicator", "id": "13b04ba9-9ceb-4429-824e-ae057d23f194", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--169f561a-c351-5704-bf93-f0619cf54f03", "toId": "65de75f2-577f-475e-9394-05450cc05a45", "to_id": "65de75f2-577f-475e-9394-05450cc05a45", "to_name": "LummaC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.286Z", "created_at": "2026-09-25T22:37:41.167Z", "modified": "2026-09-25T22:37:41.522Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:37:41.522Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6153c912-e546-4292-b04a-e680a4e39367", "from_id": "6153c912-e546-4292-b04a-e680a4e39367", "from_name": null, "from_type": "Indicator", "id": "1464d5e9-79fc-4ef7-8ca0-845ff35674e0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--34b8f5de-0d9d-56a1-94ab-b62ad3c8f12b", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.176Z", "created_at": "2026-09-25T22:34:02.815Z", "modified": "2026-09-25T22:34:03.251Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:34:03.251Z" }, "description_available": false, "entity_type": "targets", "fromId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_name": "MacSync", "from_type": "Malware", "id": "14b914ad-155e-48a9-b785-9c92ed224aab", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--4fd20da9-5671-5b59-8e77-0659cc457121", "toId": "1dd71a00-5740-4802-b05e-d76e46b5469c", "to_id": "1dd71a00-5740-4802-b05e-d76e46b5469c", "to_name": "Singapore", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.044Z", "created_at": "2026-01-18T14:39:00.892Z", "modified": "2026-01-18T14:39:01.182Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:01.182Z" }, "description_available": true, "entity_type": "located-at", "fromId": "6926835d-28e0-4787-97c9-699d0375b12b", "from_id": "6926835d-28e0-4787-97c9-699d0375b12b", "from_name": "India", "from_type": "Country", "id": "1943dcbb-b312-436e-873f-c3cef811d6bc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--f7bc8131-8473-5cdd-9b6d-660635e5d317", "toId": "0edd7cee-c750-4a70-82dc-a493fef311a8", "to_id": "0edd7cee-c750-4a70-82dc-a493fef311a8", "to_name": "Southern Asia", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.210Z", "created_at": "2026-09-25T22:36:13.422Z", "modified": "2026-09-25T22:36:13.746Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:36:13.746Z" }, "description_available": false, "entity_type": "based-on", "fromId": "24fc8125-aab7-470f-97fd-f7d447ba5095", "from_id": "24fc8125-aab7-470f-97fd-f7d447ba5095", "from_name": null, "from_type": "Indicator", "id": "1cff82a0-f7f2-408d-9ca8-367df0a83ba9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--45340009-9399-5241-b5a1-b5b7f5441973", "toId": "27771ccd-ca69-4e78-b3e8-22c098f5e1b6", "to_id": "27771ccd-ca69-4e78-b3e8-22c098f5e1b6", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.172Z", "created_at": "2026-09-25T22:33:58.380Z", "modified": "2026-09-25T22:33:58.854Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:33:58.854Z" }, "description_available": false, "entity_type": "targets", "fromId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_name": "MacSync", "from_type": "Malware", "id": "1da4274e-e182-4a29-bc1e-4f29a2343a3c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--1d9ae76b-3a27-58c8-8ca4-67df43f8bd13", "toId": "402b2086-638d-4a79-88bb-c79acff485d8", "to_id": "402b2086-638d-4a79-88bb-c79acff485d8", "to_name": "Australia", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.190Z", "created_at": "2026-09-25T22:34:15.141Z", "modified": "2026-09-25T22:34:15.410Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:34:15.410Z" }, "description_available": false, "entity_type": "targets", "fromId": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_name": "Stealc", "from_type": "Malware", "id": "1f7a51c2-e9e6-4f43-ae00-2639ac5a4ceb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--2aa9a98c-05d3-5f91-b8b5-1e9495141673", "toId": "9ebd9843-38da-417d-8c94-c4c6e1ef07af", "to_id": "9ebd9843-38da-417d-8c94-c4c6e1ef07af", "to_name": "Netherlands", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.297Z", "created_at": "2026-09-25T22:37:55.431Z", "modified": "2026-09-25T22:37:55.757Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:37:55.757Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0284f8d3-8d1e-4099-b425-1dfdf3756b24", "from_id": "0284f8d3-8d1e-4099-b425-1dfdf3756b24", "from_name": null, "from_type": "Indicator", "id": "1fa4bd1e-52ff-49e8-9394-1b8c8d18c9a7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--e7e2303b-9011-5ca0-b886-9382c599e07f", "toId": "65de75f2-577f-475e-9394-05450cc05a45", "to_id": "65de75f2-577f-475e-9394-05450cc05a45", "to_name": "LummaC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.001Z", "created_at": "2026-01-18T14:37:23.973Z", "modified": "2026-01-18T14:37:24.172Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:37:24.172Z" }, "description_available": true, "entity_type": "located-at", "fromId": "f571f0ef-816b-43b9-98be-7dd1ec907646", "from_id": "f571f0ef-816b-43b9-98be-7dd1ec907646", "from_name": "British Indian Ocean Territory", "from_type": "Country", "id": "2583270a-b17f-4374-9d91-f191ee3f1eb8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--1ac96288-b57b-5204-a37b-5e60317969a7", "toId": "2ddebcb7-f192-4ba6-9d42-5f830cffc4c8", "to_id": "2ddebcb7-f192-4ba6-9d42-5f830cffc4c8", "to_name": "Sub-Saharan Africa", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T18:54:44.599Z", "created_at": "2026-03-04T09:22:57.130Z", "modified": "2026-03-04T09:22:57.693Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-04T09:22:57.693Z" }, "description_available": false, "entity_type": "targets", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "290d204c-0849-469c-8cac-8edc03a0e06e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--edf8b818-702c-5f0c-a3ee-2c9a2bdf3af4", "toId": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_id": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_name": "Government and administrations", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:23:53.574Z", "created_at": "2026-03-09T14:48:11.809Z", "modified": "2026-03-09T14:48:12.940Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-09T14:48:12.940Z" }, "description_available": false, "entity_type": "targets", "fromId": "65de75f2-577f-475e-9394-05450cc05a45", "from_id": "65de75f2-577f-475e-9394-05450cc05a45", "from_name": "LummaC2", "from_type": "Malware", "id": "2c0c9a1f-b69a-45f0-bd4c-1b7022a62208", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--7197cd60-834c-5c01-a72a-8169527f3184", "toId": "3460c7f0-1521-461b-af64-2de060664fb1", "to_id": "3460c7f0-1521-461b-af64-2de060664fb1", "to_name": "United States of America", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T17:58:00.417Z", "created_at": "2026-02-22T23:47:57.513Z", "modified": "2026-02-22T23:48:19.865Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-02-22T23:48:19.865Z" }, "description_available": false, "entity_type": "targets", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "2c42ff18-71a2-4d77-9f23-255dc715914b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--6921cb13-d98b-5624-a3da-ba7ac507b0ee", "toId": "c31973cc-3fba-4e06-8ae7-41954e92d90f", "to_id": "c31973cc-3fba-4e06-8ae7-41954e92d90f", "to_name": "Germany", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.320Z", "created_at": "2026-09-25T22:38:29.458Z", "modified": "2026-09-25T22:38:29.656Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:38:29.656Z" }, "description_available": false, "entity_type": "indicates", "fromId": "05249b1e-20c2-4d0c-8b6b-042029a7e4e6", "from_id": "05249b1e-20c2-4d0c-8b6b-042029a7e4e6", "from_name": null, "from_type": "Indicator", "id": "2d91a969-31dc-4554-89ba-d2ae5584304e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--89b026ae-99df-55f6-8874-46e6dd0c490d", "toId": "65de75f2-577f-475e-9394-05450cc05a45", "to_id": "65de75f2-577f-475e-9394-05450cc05a45", "to_name": "LummaC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.240Z", "created_at": "2026-09-25T22:36:36.322Z", "modified": "2026-09-25T22:36:37.924Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:36:37.924Z" }, "description_available": false, "entity_type": "indicates", "fromId": "46793d9f-2092-4522-909c-16fbded66c1b", "from_id": "46793d9f-2092-4522-909c-16fbded66c1b", "from_name": null, "from_type": "Indicator", "id": "2f0981c1-6c24-4340-b2d9-088eed91d4c3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--6d56c8fd-6746-546d-b39a-d2088c66a53c", "toId": "90740c7b-0969-4359-a452-1a4775ff4af2", "to_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "to_name": "Stealc", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.062Z", "created_at": "2026-01-18T14:39:54.991Z", "modified": "2026-01-18T14:39:56.326Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:56.326Z" }, "description_available": true, "entity_type": "located-at", "fromId": "9ebd9843-38da-417d-8c94-c4c6e1ef07af", "from_id": "9ebd9843-38da-417d-8c94-c4c6e1ef07af", "from_name": "Netherlands", "from_type": "Country", "id": "2f9b2aa4-c4d8-4d14-8ddb-071a4e9c9033", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--63fbac78-03f5-5507-9258-6bf1d7182295", "toId": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "to_id": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "to_name": "Western Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T20:29:11.714Z", "created_at": "2026-03-24T16:25:32.650Z", "modified": "2026-03-24T16:25:35.251Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-24T16:25:35.251Z" }, "description_available": false, "entity_type": "targets", "fromId": "65de75f2-577f-475e-9394-05450cc05a45", "from_id": "65de75f2-577f-475e-9394-05450cc05a45", "from_name": "LummaC2", "from_type": "Malware", "id": "313e8a06-aff5-4b54-b5b6-1d3cdf31b127", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--df1fb30b-11f0-57a2-b44a-75c9bcdaf84d", "toId": "6926835d-28e0-4787-97c9-699d0375b12b", "to_id": "6926835d-28e0-4787-97c9-699d0375b12b", "to_name": "India", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.205Z", "created_at": "2026-09-25T22:36:08.142Z", "modified": "2026-09-25T22:36:10.080Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:36:10.080Z" }, "description_available": false, "entity_type": "based-on", "fromId": "53db8b3c-0fa9-4f49-ad94-7ddbe4261845", "from_id": "53db8b3c-0fa9-4f49-ad94-7ddbe4261845", "from_name": null, "from_type": "Indicator", "id": "322a6076-e5d0-4d85-81bb-06d45f4a4eae", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--6d30c96f-7294-5995-b279-d2e88a8200bc", "toId": "a4a737cc-ac86-4db1-818b-92472abb1cf0", "to_id": "a4a737cc-ac86-4db1-818b-92472abb1cf0", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.174Z", "created_at": "2026-09-25T22:33:56.494Z", "modified": "2026-09-25T22:33:56.837Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:33:56.837Z" }, "description_available": false, "entity_type": "targets", "fromId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_name": "MacSync", "from_type": "Malware", "id": "33abf943-4d14-4ed3-b782-845e563e1a04", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--aa8d3983-f00c-508b-b8b7-4c234496f9c7", "toId": "c31973cc-3fba-4e06-8ae7-41954e92d90f", "to_id": "c31973cc-3fba-4e06-8ae7-41954e92d90f", "to_name": "Germany", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.188Z", "created_at": "2026-09-25T22:34:12.178Z", "modified": "2026-09-25T22:34:12.521Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:34:12.521Z" }, "description_available": false, "entity_type": "targets", "fromId": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_name": "Stealc", "from_type": "Malware", "id": "369d4ade-af16-4632-8154-734d6d2be983", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--1467bcd1-ef18-527f-b6b6-8d6a371b7343", "toId": "c31973cc-3fba-4e06-8ae7-41954e92d90f", "to_id": "c31973cc-3fba-4e06-8ae7-41954e92d90f", "to_name": "Germany", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.175Z", "created_at": "2026-09-25T22:34:04.220Z", "modified": "2026-09-25T22:34:04.607Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:34:04.607Z" }, "description_available": false, "entity_type": "targets", "fromId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_name": "MacSync", "from_type": "Malware", "id": "378d7e88-50c5-433d-839d-d487ad83f877", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--5b062a41-2e00-531a-a657-a7808f293d12", "toId": "9ebd9843-38da-417d-8c94-c4c6e1ef07af", "to_id": "9ebd9843-38da-417d-8c94-c4c6e1ef07af", "to_name": "Netherlands", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.057Z", "created_at": "2026-01-18T14:39:38.323Z", "modified": "2026-01-18T14:39:38.509Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:38.509Z" }, "description_available": true, "entity_type": "located-at", "fromId": "f2fc791f-b777-4d8f-87a6-5e87abeec776", "from_id": "f2fc791f-b777-4d8f-87a6-5e87abeec776", "from_name": "United Kingdom of Great Britain and Northern Ireland", "from_type": "Country", "id": "384f404b-1b13-4e2c-b360-ef51feb026c8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--e3cb58c7-3ba5-5f88-b0a8-b69046948322", "toId": "d5563518-7ebb-46ed-a037-525564906cd9", "to_id": "d5563518-7ebb-46ed-a037-525564906cd9", "to_name": "Northern Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.342Z", "created_at": "2026-09-25T22:38:56.323Z", "modified": "2026-09-25T22:38:56.678Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:38:56.678Z" }, "description_available": false, "entity_type": "indicates", "fromId": "57747752-926b-47ee-90bf-07f8084c6ca2", "from_id": "57747752-926b-47ee-90bf-07f8084c6ca2", "from_name": null, "from_type": "Indicator", "id": "39f3a4d5-b507-4a2a-81fc-24a034364b6a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--d5f245d1-a868-5e51-91e0-f0fbc616f0bb", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.042Z", "created_at": "2026-01-18T14:38:56.537Z", "modified": "2026-01-18T14:38:56.699Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:56.699Z" }, "description_available": true, "entity_type": "located-at", "fromId": "1dd71a00-5740-4802-b05e-d76e46b5469c", "from_id": "1dd71a00-5740-4802-b05e-d76e46b5469c", "from_name": "Singapore", "from_type": "Country", "id": "3c7f28e6-014f-4359-80ea-2d26c3322557", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--18330ccd-7867-5483-9b94-1d893cdcde2c", "toId": "c0c50eda-edd8-4175-a851-a0bb39fc00cb", "to_id": "c0c50eda-edd8-4175-a851-a0bb39fc00cb", "to_name": "South-eastern Asia", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.186Z", "created_at": "2026-09-25T22:34:11.523Z", "modified": "2026-09-25T22:34:11.746Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:34:11.746Z" }, "description_available": false, "entity_type": "targets", "fromId": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_name": "Stealc", "from_type": "Malware", "id": "3db837a4-ff18-4325-b20a-9dc5b8e5487d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--964ca6f2-f8df-574f-b868-020c8a61f1b0", "toId": "f571f0ef-816b-43b9-98be-7dd1ec907646", "to_id": "f571f0ef-816b-43b9-98be-7dd1ec907646", "to_name": "British Indian Ocean Territory", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.179Z", "created_at": "2026-09-25T22:34:04.898Z", "modified": "2026-09-25T22:34:05.172Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:34:05.172Z" }, "description_available": false, "entity_type": "targets", "fromId": "65de75f2-577f-475e-9394-05450cc05a45", "from_id": "65de75f2-577f-475e-9394-05450cc05a45", "from_name": "LummaC2", "from_type": "Malware", "id": "408f291e-d9a6-4c13-8162-88f6cabf1375", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--68254a03-e0dd-5fd6-b238-44ef9665162c", "toId": "2f8a4ddc-793d-43b9-a7fc-a29d93a0db1d", "to_id": "2f8a4ddc-793d-43b9-a7fc-a29d93a0db1d", "to_name": "Canada", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.060Z", "created_at": "2026-01-18T14:39:48.201Z", "modified": "2026-01-18T14:39:48.601Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:48.601Z" }, "description_available": true, "entity_type": "located-at", "fromId": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "from_id": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "from_name": "Western Europe", "from_type": "Region", "id": "42e7a8d1-4ff2-49b2-8955-e523f876fd14", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--a8c89c99-5dee-56fe-ab02-c5269d6a6624", "toId": "6e23d1d1-9fea-43f8-a01c-f1b416f6e558", "to_id": "6e23d1d1-9fea-43f8-a01c-f1b416f6e558", "to_name": "Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.190Z", "created_at": "2026-09-25T22:34:34.511Z", "modified": "2026-09-25T22:34:35.973Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:34:35.973Z" }, "description_available": false, "entity_type": "targets", "fromId": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_name": "Stealc", "from_type": "Malware", "id": "4416cb45-8905-4fcf-96cb-0ec100515d6c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--3fd19fc9-ebc4-5ac3-ad52-ff61cbb2b574", "toId": "1dd71a00-5740-4802-b05e-d76e46b5469c", "to_id": "1dd71a00-5740-4802-b05e-d76e46b5469c", "to_name": "Singapore", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.032Z", "created_at": "2026-01-18T14:38:39.061Z", "modified": "2026-01-18T14:38:39.335Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:39.335Z" }, "description_available": true, "entity_type": "located-at", "fromId": "3f84bc21-010c-46a3-bad3-432dcd70f556", "from_id": "3f84bc21-010c-46a3-bad3-432dcd70f556", "from_name": "Northern America", "from_type": "Region", "id": "4a3ffcd5-bd03-47c6-a71d-4c47c1151811", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--35fa17bc-cd76-5e88-b582-d1c577aa86ba", "toId": "0584d53c-836c-41a4-a732-0edcc5dea653", "to_id": "0584d53c-836c-41a4-a732-0edcc5dea653", "to_name": "Americas", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.309Z", "created_at": "2026-09-25T22:38:15.470Z", "modified": "2026-09-25T22:38:15.653Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:38:15.653Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ac3fae9c-f9c3-44bf-9e7c-14f92e81e1cd", "from_id": "ac3fae9c-f9c3-44bf-9e7c-14f92e81e1cd", "from_name": null, "from_type": "Indicator", "id": "4adcf821-7a89-4ae9-a615-ccae75528232", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--bbc4735f-cf74-5239-a8f3-fc8357373f74", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.213Z", "created_at": "2026-09-25T22:36:14.254Z", "modified": "2026-09-25T22:36:14.816Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:36:14.816Z" }, "description_available": false, "entity_type": "based-on", "fromId": "6153c912-e546-4292-b04a-e680a4e39367", "from_id": "6153c912-e546-4292-b04a-e680a4e39367", "from_name": null, "from_type": "Indicator", "id": "4af245a8-d1c1-407d-b754-989bc8823f1f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--09f660bb-587a-5ab5-9137-cc87e08d87af", "toId": "f9a660d3-db90-4a47-868e-7c12473af38e", "to_id": "f9a660d3-db90-4a47-868e-7c12473af38e", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.196Z", "created_at": "2026-09-25T22:34:49.839Z", "modified": "2026-09-25T22:34:57.157Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:34:57.157Z" }, "description_available": false, "entity_type": "targets", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "4b796ab5-a8a4-4e1c-a567-59d1bf94d4f0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--f08fdf55-e73f-5f9b-a650-94c59554de07", "toId": "9ebd9843-38da-417d-8c94-c4c6e1ef07af", "to_id": "9ebd9843-38da-417d-8c94-c4c6e1ef07af", "to_name": "Netherlands", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.216Z", "created_at": "2026-09-25T22:36:14.753Z", "modified": "2026-09-25T22:36:15.221Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:36:15.221Z" }, "description_available": false, "entity_type": "based-on", "fromId": "0284f8d3-8d1e-4099-b425-1dfdf3756b24", "from_id": "0284f8d3-8d1e-4099-b425-1dfdf3756b24", "from_name": null, "from_type": "Indicator", "id": "4cff57ae-7923-4495-aa78-05b0030a6b91", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--5456153a-4dd7-52b9-a389-b240685146e7", "toId": "f7c4d4ae-ca64-4c26-8f3e-236e5f24c9a1", "to_id": "f7c4d4ae-ca64-4c26-8f3e-236e5f24c9a1", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.263Z", "created_at": "2026-09-25T22:37:17.527Z", "modified": "2026-09-25T22:37:17.715Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:37:17.715Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1e66c154-5bf9-4459-a289-4958e39f1a31", "from_id": "1e66c154-5bf9-4459-a289-4958e39f1a31", "from_name": null, "from_type": "Indicator", "id": "4ffc71d3-3478-4e00-b5a1-843d04a696b7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--4be5e557-b6bf-5b1d-8788-b91c640bee40", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.284Z", "created_at": "2026-09-25T22:37:40.269Z", "modified": "2026-09-25T22:37:40.420Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:37:40.420Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6153c912-e546-4292-b04a-e680a4e39367", "from_id": "6153c912-e546-4292-b04a-e680a4e39367", "from_name": null, "from_type": "Indicator", "id": "5260c559-8c80-4fdc-b375-6d06e470c629", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--3a5e4f49-b4e0-5a37-a033-d1110c6204ca", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.061Z", "created_at": "2026-01-18T14:39:51.573Z", "modified": "2026-01-18T14:39:51.848Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:51.848Z" }, "description_available": true, "entity_type": "located-at", "fromId": "28acec63-0804-49d2-95fa-8beb12f12b33", "from_id": "28acec63-0804-49d2-95fa-8beb12f12b33", "from_name": "France", "from_type": "Country", "id": "55355b78-b31e-4a4d-902e-2ad5aa324f55", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--5e1293d5-a319-5fe8-b3b9-dc5550bb674e", "toId": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "to_id": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "to_name": "Western Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.182Z", "created_at": "2026-09-25T22:34:06.239Z", "modified": "2026-09-25T22:34:08.214Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:34:08.214Z" }, "description_available": false, "entity_type": "targets", "fromId": "65de75f2-577f-475e-9394-05450cc05a45", "from_id": "65de75f2-577f-475e-9394-05450cc05a45", "from_name": "LummaC2", "from_type": "Malware", "id": "55a0c04c-bd7e-4d93-9d20-544a21f716d8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--d66b0f0b-21bb-54a2-91ca-c16928943974", "toId": "1dd71a00-5740-4802-b05e-d76e46b5469c", "to_id": "1dd71a00-5740-4802-b05e-d76e46b5469c", "to_name": "Singapore", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:59:12.142Z", "created_at": "2026-03-16T07:54:13.965Z", "modified": "2026-03-16T07:54:14.546Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-16T07:54:14.546Z" }, "description_available": false, "entity_type": "targets", "fromId": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_name": "Stealc", "from_type": "Malware", "id": "59245828-3eca-44fd-bd25-fc10bbc437d0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--6c5f5ba0-36b0-5421-a0fd-25c3c64b2728", "toId": "3460c7f0-1521-461b-af64-2de060664fb1", "to_id": "3460c7f0-1521-461b-af64-2de060664fb1", "to_name": "United States of America", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.227Z", "created_at": "2026-09-25T22:36:34.997Z", "modified": "2026-09-25T22:36:35.200Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:36:35.200Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f70940b5-5820-41e9-ae9b-5932d562dda4", "from_id": "f70940b5-5820-41e9-ae9b-5932d562dda4", "from_name": null, "from_type": "Indicator", "id": "59d5cd49-6c42-4fd3-9d69-eabd007071e5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--c4e5d3aa-943b-511b-831e-6bc4092f081e", "toId": "90740c7b-0969-4359-a452-1a4775ff4af2", "to_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "to_name": "Stealc", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.343Z", "created_at": "2026-09-25T22:39:06.460Z", "modified": "2026-09-25T22:39:06.772Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:39:06.772Z" }, "description_available": false, "entity_type": "indicates", "fromId": "57747752-926b-47ee-90bf-07f8084c6ca2", "from_id": "57747752-926b-47ee-90bf-07f8084c6ca2", "from_name": null, "from_type": "Indicator", "id": "5a9cdf9a-6f7d-4511-934b-e3da04e4659d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--8d927cb2-dd7e-56f4-a69b-31db419b7a1a", "toId": "90740c7b-0969-4359-a452-1a4775ff4af2", "to_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "to_name": "Stealc", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.226Z", "created_at": "2026-09-25T22:36:18.842Z", "modified": "2026-09-25T22:36:19.465Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:36:19.465Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f70940b5-5820-41e9-ae9b-5932d562dda4", "from_id": "f70940b5-5820-41e9-ae9b-5932d562dda4", "from_name": null, "from_type": "Indicator", "id": "5abe7720-673e-422c-b6d4-08bf68b8d1ec", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--ab635964-031c-58af-861f-e843b50ee986", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.156Z", "created_at": "2026-09-25T22:33:46.899Z", "modified": "2026-09-25T22:33:47.202Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:33:47.202Z" }, "description_available": false, "entity_type": "targets", "fromId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_name": "MacSync", "from_type": "Malware", "id": "5b922c36-5b56-44ab-a32f-5617a7a665b5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--126885e0-4830-5a2a-a401-b16fe5392656", "toId": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_id": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_name": "Government and administrations", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.218Z", "created_at": "2026-09-25T22:36:14.756Z", "modified": "2026-09-25T22:36:15.466Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:36:15.466Z" }, "description_available": false, "entity_type": "based-on", "fromId": "ac3fae9c-f9c3-44bf-9e7c-14f92e81e1cd", "from_id": "ac3fae9c-f9c3-44bf-9e7c-14f92e81e1cd", "from_name": null, "from_type": "Indicator", "id": "603e54c1-40ea-4a43-9def-7cc9ab8002de", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--32df9f95-8d8a-5380-9f67-193a1560e070", "toId": "593f83b0-dd55-42da-92bb-4d803401255e", "to_id": "593f83b0-dd55-42da-92bb-4d803401255e", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.298Z", "created_at": "2026-09-25T22:37:56.793Z", "modified": "2026-09-25T22:37:57.263Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:37:57.263Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0284f8d3-8d1e-4099-b425-1dfdf3756b24", "from_id": "0284f8d3-8d1e-4099-b425-1dfdf3756b24", "from_name": null, "from_type": "Indicator", "id": "62fd2695-02c8-4601-94d2-90477fee57d0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--1f184fc9-8edf-5689-8f36-1400966cc51c", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.195Z", "created_at": "2026-09-25T22:34:38.594Z", "modified": "2026-09-25T22:34:41.135Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:34:41.135Z" }, "description_available": false, "entity_type": "targets", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "64fc2645-d94a-45bb-a17f-8734c689bf8f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--97a285cc-b540-5468-a99e-9b36f34f8953", "toId": "7a370bce-880b-477d-b87c-2fc78164dde9", "to_id": "7a370bce-880b-477d-b87c-2fc78164dde9", "to_name": "Japan", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.239Z", "created_at": "2026-09-25T22:36:50.584Z", "modified": "2026-09-25T22:36:50.765Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:36:50.765Z" }, "description_available": false, "entity_type": "indicates", "fromId": "46793d9f-2092-4522-909c-16fbded66c1b", "from_id": "46793d9f-2092-4522-909c-16fbded66c1b", "from_name": null, "from_type": "Indicator", "id": "66ff493f-ceda-4b7a-ba41-fad09b647b62", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--c623faef-c82b-5db3-be87-4d8c45212608", "toId": "65de75f2-577f-475e-9394-05450cc05a45", "to_id": "65de75f2-577f-475e-9394-05450cc05a45", "to_name": "LummaC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.175Z", "created_at": "2026-09-25T22:33:59.775Z", "modified": "2026-09-25T22:34:00.096Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:34:00.096Z" }, "description_available": false, "entity_type": "targets", "fromId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_name": "MacSync", "from_type": "Malware", "id": "6850e4c8-6dc5-4108-b459-e1033fe5c9e4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--93f1a570-4c70-50e6-a64d-b3b0da4cbb92", "toId": "7a370bce-880b-477d-b87c-2fc78164dde9", "to_id": "7a370bce-880b-477d-b87c-2fc78164dde9", "to_name": "Japan", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.159Z", "created_at": "2026-09-25T22:33:50.344Z", "modified": "2026-09-25T22:33:50.834Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:33:50.834Z" }, "description_available": false, "entity_type": "targets", "fromId": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_name": "Stealc", "from_type": "Malware", "id": "68a88bc7-bd3e-40d5-824f-9773f7e0e161", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--c31dd41a-5cbc-5e50-b14d-b513d8411591", "toId": "25243a50-06ec-4c1b-8fb2-6a96793e8404", "to_id": "25243a50-06ec-4c1b-8fb2-6a96793e8404", "to_name": "Technologies", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T22:01:51.887Z", "created_at": "2026-04-03T20:20:42.572Z", "modified": "2026-04-03T20:20:43.294Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-04-03T20:20:43.294Z" }, "description_available": false, "entity_type": "targets", "fromId": "65de75f2-577f-475e-9394-05450cc05a45", "from_id": "65de75f2-577f-475e-9394-05450cc05a45", "from_name": "LummaC2", "from_type": "Malware", "id": "6c9bd9fb-3961-4363-8ae2-7c7cea968f01", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--1328b381-c227-5da7-88ca-e3ad8351cf61", "toId": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_id": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_name": "Finance", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.331Z", "created_at": "2026-09-25T22:38:44.242Z", "modified": "2026-09-25T22:38:44.409Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:38:44.409Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ef94c79b-d454-4cb3-bf81-7da9cdc5ef8e", "from_id": "ef94c79b-d454-4cb3-bf81-7da9cdc5ef8e", "from_name": null, "from_type": "Indicator", "id": "6dbcfbb5-748b-4531-9f16-e1341eec0cb2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--a3cb7938-703f-575d-9039-afa0a2105778", "toId": "65de75f2-577f-475e-9394-05450cc05a45", "to_id": "65de75f2-577f-475e-9394-05450cc05a45", "to_name": "LummaC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.331Z", "created_at": "2026-09-25T22:38:42.143Z", "modified": "2026-09-25T22:38:42.465Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:38:42.465Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ef94c79b-d454-4cb3-bf81-7da9cdc5ef8e", "from_id": "ef94c79b-d454-4cb3-bf81-7da9cdc5ef8e", "from_name": null, "from_type": "Indicator", "id": "6ddb2426-1885-4153-bc05-629f273e45d6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--c1e36480-5fbc-52a5-ba3e-7d7476409040", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.187Z", "created_at": "2026-09-25T22:34:10.676Z", "modified": "2026-09-25T22:34:10.965Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:34:10.965Z" }, "description_available": false, "entity_type": "targets", "fromId": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_name": "Stealc", "from_type": "Malware", "id": "6f324121-2c8b-47dc-bc9d-f4b512693ee5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--3c2aa9e1-25d1-5bc1-a9f5-d328968efae3", "toId": "2f8a4ddc-793d-43b9-a7fc-a29d93a0db1d", "to_id": "2f8a4ddc-793d-43b9-a7fc-a29d93a0db1d", "to_name": "Canada", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.320Z", "created_at": "2026-09-25T22:38:40.062Z", "modified": "2026-09-25T22:38:40.333Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:38:40.333Z" }, "description_available": false, "entity_type": "indicates", "fromId": "05249b1e-20c2-4d0c-8b6b-042029a7e4e6", "from_id": "05249b1e-20c2-4d0c-8b6b-042029a7e4e6", "from_name": null, "from_type": "Indicator", "id": "7176a6cc-aff0-4677-9a5f-0106243e1cb6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--4fbb6475-47cf-5b2e-a32f-288a5971a80d", "toId": "90740c7b-0969-4359-a452-1a4775ff4af2", "to_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "to_name": "Stealc", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T18:54:44.605Z", "created_at": "2026-03-04T09:22:59.758Z", "modified": "2026-08-11T04:45:59.953Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-08-11T04:45:59.953Z" }, "description_available": false, "entity_type": "targets", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "73296894-b530-4ba7-862d-c07a9c914555", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--63d85d5c-f241-531f-9f74-3356aa42def5", "toId": "25243a50-06ec-4c1b-8fb2-6a96793e8404", "to_id": "25243a50-06ec-4c1b-8fb2-6a96793e8404", "to_name": "Technologies", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.184Z", "created_at": "2026-09-25T22:34:10.005Z", "modified": "2026-09-25T22:34:10.215Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:34:10.215Z" }, "description_available": false, "entity_type": "targets", "fromId": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_name": "Stealc", "from_type": "Malware", "id": "799b5210-188c-4efc-92ec-f19e41555b75", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--051f941e-57e7-5c02-b430-48d7f765b9ee", "toId": "402b2086-638d-4a79-88bb-c79acff485d8", "to_id": "402b2086-638d-4a79-88bb-c79acff485d8", "to_name": "Australia", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.181Z", "created_at": "2026-09-25T22:34:09.210Z", "modified": "2026-09-25T22:34:09.464Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:34:09.464Z" }, "description_available": false, "entity_type": "targets", "fromId": "65de75f2-577f-475e-9394-05450cc05a45", "from_id": "65de75f2-577f-475e-9394-05450cc05a45", "from_name": "LummaC2", "from_type": "Malware", "id": "7a38ece3-30e1-4b44-b19c-c8411cc79299", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--8a5ca63b-11ba-5667-aef2-5dac498a6795", "toId": "9ebd9843-38da-417d-8c94-c4c6e1ef07af", "to_id": "9ebd9843-38da-417d-8c94-c4c6e1ef07af", "to_name": "Netherlands", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.062Z", "created_at": "2026-01-18T14:39:54.345Z", "modified": "2026-01-18T14:39:54.701Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:54.701Z" }, "description_available": true, "entity_type": "located-at", "fromId": "2730372a-ef6c-4210-bc27-805102dc639f", "from_id": "2730372a-ef6c-4210-bc27-805102dc639f", "from_name": "Australia and New Zealand", "from_type": "Region", "id": "7abe29ae-6c1f-49ff-866a-69f3404f3cc3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--2ad84e60-8fdf-53b7-9240-b55c5bacdb59", "toId": "6c3ce996-c654-4b25-8b6d-f983459d54a6", "to_id": "6c3ce996-c654-4b25-8b6d-f983459d54a6", "to_name": "Oceania", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.223Z", "created_at": "2026-09-25T22:36:16.167Z", "modified": "2026-09-25T22:36:18.087Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:36:18.087Z" }, "description_available": false, "entity_type": "based-on", "fromId": "ef94c79b-d454-4cb3-bf81-7da9cdc5ef8e", "from_id": "ef94c79b-d454-4cb3-bf81-7da9cdc5ef8e", "from_name": null, "from_type": "Indicator", "id": "7e8e5545-8f5b-4e7f-b336-531ea70d3a1a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--e6de6f58-4f35-52ea-8254-b65f0c3717e4", "toId": "501e7702-f8eb-4444-af95-c9a147450a5a", "to_id": "501e7702-f8eb-4444-af95-c9a147450a5a", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.307Z", "created_at": "2026-09-25T22:38:12.801Z", "modified": "2026-09-25T22:38:13.061Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:38:13.061Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ac3fae9c-f9c3-44bf-9e7c-14f92e81e1cd", "from_id": "ac3fae9c-f9c3-44bf-9e7c-14f92e81e1cd", "from_name": null, "from_type": "Indicator", "id": "7ef8638c-eff2-48fb-8514-c5cc703309bc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--8ff88529-a38e-5968-af2c-4349511b794a", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-07-11T19:31:59.933Z", "created_at": "2026-07-12T02:33:29.801Z", "modified": "2026-07-12T02:33:30.058Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-07-12T02:33:30.058Z" }, "description_available": false, "entity_type": "targets", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "81d450fe-b80a-487e-afe5-e2a6c23f8237", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--4c03a6c1-5029-5a38-a9c9-7a93d96a126c", "toId": "f571f0ef-816b-43b9-98be-7dd1ec907646", "to_id": "f571f0ef-816b-43b9-98be-7dd1ec907646", "to_name": "British Indian Ocean Territory", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.033Z", "created_at": "2026-01-18T14:38:39.617Z", "modified": "2026-01-18T14:38:39.914Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:39.914Z" }, "description_available": true, "entity_type": "located-at", "fromId": "2f8a4ddc-793d-43b9-a7fc-a29d93a0db1d", "from_id": "2f8a4ddc-793d-43b9-a7fc-a29d93a0db1d", "from_name": "Canada", "from_type": "Country", "id": "82f3bb63-a4b8-44b1-aba8-752a04dcda6d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--434f73f1-3b64-55f7-b4c9-da009fa7f1f7", "toId": "3f84bc21-010c-46a3-bad3-432dcd70f556", "to_id": "3f84bc21-010c-46a3-bad3-432dcd70f556", "to_name": "Northern America", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.274Z", "created_at": "2026-09-25T22:37:25.867Z", "modified": "2026-09-25T22:37:27.697Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:37:27.697Z" }, "description_available": false, "entity_type": "indicates", "fromId": "24fc8125-aab7-470f-97fd-f7d447ba5095", "from_id": "24fc8125-aab7-470f-97fd-f7d447ba5095", "from_name": null, "from_type": "Indicator", "id": "83e89463-0dee-42e4-a536-192442b4f8cc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--ca1d7ad2-c0cc-5b39-9c9f-2594cd44db2e", "toId": "90740c7b-0969-4359-a452-1a4775ff4af2", "to_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "to_name": "Stealc", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.275Z", "created_at": "2026-09-25T22:37:29.832Z", "modified": "2026-09-25T22:37:30.170Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:37:30.170Z" }, "description_available": false, "entity_type": "indicates", "fromId": "24fc8125-aab7-470f-97fd-f7d447ba5095", "from_id": "24fc8125-aab7-470f-97fd-f7d447ba5095", "from_name": null, "from_type": "Indicator", "id": "849ebb48-2bab-4371-a08b-06cc37a3ea35", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--caea2395-0b54-598b-a3c0-37f1571ebe58", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.296Z", "created_at": "2026-09-25T22:37:54.899Z", "modified": "2026-09-25T22:37:55.096Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:37:55.096Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0284f8d3-8d1e-4099-b425-1dfdf3756b24", "from_id": "0284f8d3-8d1e-4099-b425-1dfdf3756b24", "from_name": null, "from_type": "Indicator", "id": "84a83773-684f-4e08-945d-8e07eb61f57c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--deb17462-524f-5110-be34-6579e413ed7c", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.188Z", "created_at": "2026-09-25T22:34:14.392Z", "modified": "2026-09-25T22:34:14.720Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:34:14.720Z" }, "description_available": false, "entity_type": "targets", "fromId": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_name": "Stealc", "from_type": "Malware", "id": "86e0912e-41a7-4e57-8be5-ff2e5a97da8f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--e4bb709a-cb74-5e06-961f-d4955399b1f7", "toId": "28acec63-0804-49d2-95fa-8beb12f12b33", "to_id": "28acec63-0804-49d2-95fa-8beb12f12b33", "to_name": "France", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T17:58:00.416Z", "created_at": "2026-02-22T23:46:36.354Z", "modified": "2026-02-22T23:46:49.186Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-02-22T23:46:49.186Z" }, "description_available": false, "entity_type": "targets", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "88127b65-7ca3-4437-b096-46406f85f7e4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--b0055574-8f09-5862-92cb-c1e4f583eef3", "toId": "28acec63-0804-49d2-95fa-8beb12f12b33", "to_id": "28acec63-0804-49d2-95fa-8beb12f12b33", "to_name": "France", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.225Z", "created_at": "2026-09-25T22:36:17.838Z", "modified": "2026-09-25T22:36:18.784Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:36:18.784Z" }, "description_available": false, "entity_type": "based-on", "fromId": "57747752-926b-47ee-90bf-07f8084c6ca2", "from_id": "57747752-926b-47ee-90bf-07f8084c6ca2", "from_name": null, "from_type": "Indicator", "id": "8d19080a-13a3-47f5-b6ec-a750a0783f6a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--878f0088-cc55-544f-8acf-9ab5536cd439", "toId": "67b9028f-0370-4be1-bc1a-6fd14683c6a8", "to_id": "67b9028f-0370-4be1-bc1a-6fd14683c6a8", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.061Z", "created_at": "2026-01-18T14:39:50.056Z", "modified": "2026-01-18T14:39:50.352Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:50.352Z" }, "description_available": true, "entity_type": "located-at", "fromId": "c31973cc-3fba-4e06-8ae7-41954e92d90f", "from_id": "c31973cc-3fba-4e06-8ae7-41954e92d90f", "from_name": "Germany", "from_type": "Country", "id": "8da103a4-5a81-4add-8d86-382e44dc00b0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--e82eefa3-aa16-545f-9d62-41ae0db89bde", "toId": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "to_id": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "to_name": "Western Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.228Z", "created_at": "2026-09-25T22:36:19.840Z", "modified": "2026-09-25T22:36:20.193Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:36:20.193Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f70940b5-5820-41e9-ae9b-5932d562dda4", "from_id": "f70940b5-5820-41e9-ae9b-5932d562dda4", "from_name": null, "from_type": "Indicator", "id": "8eb4dc76-373d-4f93-8309-83f36fa8fc01", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--201d3563-b6ca-5d0f-aeee-3d2948fe715a", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.174Z", "created_at": "2026-09-25T22:34:00.578Z", "modified": "2026-09-25T22:34:02.374Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:34:02.374Z" }, "description_available": false, "entity_type": "targets", "fromId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_name": "MacSync", "from_type": "Malware", "id": "90b8a085-9e7d-45b8-b7ff-a856c9876cfb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--64e6b252-542b-5b02-a897-4c44f61216c6", "toId": "6926835d-28e0-4787-97c9-699d0375b12b", "to_id": "6926835d-28e0-4787-97c9-699d0375b12b", "to_name": "India", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.308Z", "created_at": "2026-09-25T22:38:13.515Z", "modified": "2026-09-25T22:38:14.952Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:38:14.952Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ac3fae9c-f9c3-44bf-9e7c-14f92e81e1cd", "from_id": "ac3fae9c-f9c3-44bf-9e7c-14f92e81e1cd", "from_name": null, "from_type": "Indicator", "id": "91367d96-1754-48f3-8449-2630bb9b61ff", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--1a1cf080-baea-54a6-b11d-e4882bc32ae2", "toId": "65de75f2-577f-475e-9394-05450cc05a45", "to_id": "65de75f2-577f-475e-9394-05450cc05a45", "to_name": "LummaC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.038Z", "created_at": "2026-01-18T14:38:45.161Z", "modified": "2026-01-18T14:38:45.423Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:45.423Z" }, "description_available": true, "entity_type": "located-at", "fromId": "5e22af61-1616-46dc-b076-551e7f99593f", "from_id": "5e22af61-1616-46dc-b076-551e7f99593f", "from_name": "Eastern Asia", "from_type": "Region", "id": "91530847-808e-41e5-ba46-b862b581cb23", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--272b6dd8-e726-5eb2-9db7-c27916944d0f", "toId": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "to_id": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "to_name": "Asia", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.041Z", "created_at": "2026-01-18T14:38:50.130Z", "modified": "2026-01-18T14:38:50.445Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:50.445Z" }, "description_available": true, "entity_type": "located-at", "fromId": "c0c50eda-edd8-4175-a851-a0bb39fc00cb", "from_id": "c0c50eda-edd8-4175-a851-a0bb39fc00cb", "from_name": "South-eastern Asia", "from_type": "Region", "id": "9529f873-617d-4b0d-bc48-1d06ac3d427d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--57b88036-b8b8-5d8e-81c8-ae50acdd7638", "toId": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "to_id": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "to_name": "Asia", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.155Z", "created_at": "2026-09-25T22:33:44.627Z", "modified": "2026-09-25T22:33:46.246Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:33:46.246Z" }, "description_available": false, "entity_type": "targets", "fromId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_name": "MacSync", "from_type": "Malware", "id": "98e81822-a0b2-487d-b4a9-91e257a6d8c9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--3e513ea0-0ca0-58d9-b4ec-b890c133ce7a", "toId": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_id": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_name": "Finance", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.344Z", "created_at": "2026-09-25T22:38:57.617Z", "modified": "2026-09-25T22:38:57.931Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:38:57.931Z" }, "description_available": false, "entity_type": "indicates", "fromId": "57747752-926b-47ee-90bf-07f8084c6ca2", "from_id": "57747752-926b-47ee-90bf-07f8084c6ca2", "from_name": null, "from_type": "Indicator", "id": "9907f67b-7e24-4a4d-a33d-07878acdc8a4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--79cc90c8-4c55-5497-abcb-2973919bf552", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.173Z", "created_at": "2026-09-25T22:34:35.503Z", "modified": "2026-09-25T22:34:37.315Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:34:37.315Z" }, "description_available": false, "entity_type": "targets", "fromId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_name": "MacSync", "from_type": "Malware", "id": "996a177f-525c-43de-813b-0826917fd615", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--356b9e1e-68bf-5c66-b8ac-655912bc5290", "toId": "28acec63-0804-49d2-95fa-8beb12f12b33", "to_id": "28acec63-0804-49d2-95fa-8beb12f12b33", "to_name": "France", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.251Z", "created_at": "2026-09-25T22:36:56.026Z", "modified": "2026-09-25T22:36:56.205Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:36:56.205Z" }, "description_available": false, "entity_type": "indicates", "fromId": "53db8b3c-0fa9-4f49-ad94-7ddbe4261845", "from_id": "53db8b3c-0fa9-4f49-ad94-7ddbe4261845", "from_name": null, "from_type": "Indicator", "id": "9e2fc052-3f69-40a0-8b98-5c1296de71b7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--1e128b05-d537-57d9-9efe-ecb2ba85b8ab", "toId": "65de75f2-577f-475e-9394-05450cc05a45", "to_id": "65de75f2-577f-475e-9394-05450cc05a45", "to_name": "LummaC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T18:54:44.727Z", "created_at": "2026-03-04T09:24:12.533Z", "modified": "2026-03-04T09:24:12.727Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-04T09:24:12.727Z" }, "description_available": false, "entity_type": "targets", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "9e3c5b47-a62a-4b37-8eb0-23e576faa2ba", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--ad24e993-1695-593c-9972-d9da4f273990", "toId": "402b2086-638d-4a79-88bb-c79acff485d8", "to_id": "402b2086-638d-4a79-88bb-c79acff485d8", "to_name": "Australia", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T17:58:00.413Z", "created_at": "2026-02-22T23:45:11.217Z", "modified": "2026-02-22T23:45:19.653Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-02-22T23:45:19.653Z" }, "description_available": false, "entity_type": "targets", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "aac36f24-56fc-482e-91d6-a1a04db73aa4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--4dfa61d9-62b6-5e2d-a590-0279c723bc3d", "toId": "3460c7f0-1521-461b-af64-2de060664fb1", "to_id": "3460c7f0-1521-461b-af64-2de060664fb1", "to_name": "United States of America", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.273Z", "created_at": "2026-09-25T22:37:24.032Z", "modified": "2026-09-25T22:37:24.200Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:37:24.200Z" }, "description_available": false, "entity_type": "indicates", "fromId": "24fc8125-aab7-470f-97fd-f7d447ba5095", "from_id": "24fc8125-aab7-470f-97fd-f7d447ba5095", "from_name": null, "from_type": "Indicator", "id": "afd64e11-b810-4c65-982b-db28536e6faf", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--ad7abfc3-cb37-5ca0-a684-cc91dc008936", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:23:53.578Z", "created_at": "2026-03-09T14:48:14.104Z", "modified": "2026-03-09T14:48:14.280Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-09T14:48:14.280Z" }, "description_available": false, "entity_type": "targets", "fromId": "65de75f2-577f-475e-9394-05450cc05a45", "from_id": "65de75f2-577f-475e-9394-05450cc05a45", "from_name": "LummaC2", "from_type": "Malware", "id": "b2a51b07-88af-4b7f-9c8a-b0814b4b8981", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--0ef58d3e-1dea-50d6-b2ae-1a7b2a47914c", "toId": "c31973cc-3fba-4e06-8ae7-41954e92d90f", "to_id": "c31973cc-3fba-4e06-8ae7-41954e92d90f", "to_name": "Germany", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-03-18T09:15:54.832Z", "created_at": "2026-04-24T18:37:18.591Z", "modified": "2026-04-24T18:37:21.451Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-04-24T18:37:21.451Z" }, "description_available": false, "entity_type": "targets", "fromId": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_name": "Stealc", "from_type": "Malware", "id": "b4a58cb2-bca9-4156-b439-4ab1070fb1e2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--92e40ac7-88f9-5925-872e-728f76c702e8", "toId": "86dceb6c-5d18-4956-8792-cf2d15d37ae5", "to_id": "86dceb6c-5d18-4956-8792-cf2d15d37ae5", "to_name": "Defense", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.176Z", "created_at": "2026-09-25T22:34:03.636Z", "modified": "2026-09-25T22:34:03.946Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:34:03.946Z" }, "description_available": false, "entity_type": "targets", "fromId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_name": "MacSync", "from_type": "Malware", "id": "b5b9bb21-c9b1-44be-9290-da710025c2af", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--cd06c770-b176-5205-bb30-c31aba9c9005", "toId": "f2fc791f-b777-4d8f-87a6-5e87abeec776", "to_id": "f2fc791f-b777-4d8f-87a6-5e87abeec776", "to_name": "United Kingdom of Great Britain and Northern Ireland", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.240Z", "created_at": "2026-09-25T22:36:38.395Z", "modified": "2026-09-25T22:36:38.711Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:36:38.711Z" }, "description_available": false, "entity_type": "indicates", "fromId": "46793d9f-2092-4522-909c-16fbded66c1b", "from_id": "46793d9f-2092-4522-909c-16fbded66c1b", "from_name": null, "from_type": "Indicator", "id": "b6d335a5-8c99-435d-a16e-6d01cd5fa39b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--c318bcfd-232f-5d7f-ad68-1348da28185f", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.263Z", "created_at": "2026-09-25T22:37:12.923Z", "modified": "2026-09-25T22:37:14.043Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:37:14.043Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1e66c154-5bf9-4459-a289-4958e39f1a31", "from_id": "1e66c154-5bf9-4459-a289-4958e39f1a31", "from_name": null, "from_type": "Indicator", "id": "b6d45c04-9b5f-4b26-9a5c-431672bc3f00", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--9056f639-5b87-5474-b982-52202b18d9e6", "toId": "90740c7b-0969-4359-a452-1a4775ff4af2", "to_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "to_name": "Stealc", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.285Z", "created_at": "2026-09-25T22:37:42.269Z", "modified": "2026-09-25T22:37:42.582Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:37:42.582Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6153c912-e546-4292-b04a-e680a4e39367", "from_id": "6153c912-e546-4292-b04a-e680a4e39367", "from_name": null, "from_type": "Indicator", "id": "b80028db-30e5-4de8-8631-503d78cc6dd2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--db2b93e8-604c-5929-8f1f-e6dafd2758af", "toId": "90740c7b-0969-4359-a452-1a4775ff4af2", "to_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "to_name": "Stealc", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.040Z", "created_at": "2026-01-18T14:38:50.870Z", "modified": "2026-01-18T14:38:52.213Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:52.213Z" }, "description_available": true, "entity_type": "located-at", "fromId": "7a370bce-880b-477d-b87c-2fc78164dde9", "from_id": "7a370bce-880b-477d-b87c-2fc78164dde9", "from_name": "Japan", "from_type": "Country", "id": "ba1c989f-7204-4e06-b9e2-1365d405256b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--0cf338f5-2612-5a1e-adb0-c70b50991dca", "toId": "5e22af61-1616-46dc-b076-551e7f99593f", "to_id": "5e22af61-1616-46dc-b076-551e7f99593f", "to_name": "Eastern Asia", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.191Z", "created_at": "2026-09-25T22:34:27.337Z", "modified": "2026-09-25T22:34:31.769Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:34:31.769Z" }, "description_available": false, "entity_type": "targets", "fromId": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_name": "Stealc", "from_type": "Malware", "id": "bb744e66-37d7-4075-b5d6-e0e1dbc6e460", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--501d6027-c988-56b5-99e4-e9b9a226c680", "toId": "f2fc791f-b777-4d8f-87a6-5e87abeec776", "to_id": "f2fc791f-b777-4d8f-87a6-5e87abeec776", "to_name": "United Kingdom of Great Britain and Northern Ireland", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:23:20.380Z", "created_at": "2026-08-09T15:12:28.541Z", "modified": "2026-08-09T15:12:29.221Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-08-09T15:12:29.221Z" }, "description_available": false, "entity_type": "based-on", "fromId": "f70940b5-5820-41e9-ae9b-5932d562dda4", "from_id": "f70940b5-5820-41e9-ae9b-5932d562dda4", "from_name": null, "from_type": "Indicator", "id": "bbc1b0c2-b46f-42a6-b478-8a2660f7a39b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--7e3b8c00-8c3b-5139-966d-49b90ca56302", "toId": "53cb35b0-94d2-4d7a-9c08-fe0aa0430190", "to_id": "53cb35b0-94d2-4d7a-9c08-fe0aa0430190", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.252Z", "created_at": "2026-09-25T22:36:56.517Z", "modified": "2026-09-25T22:36:56.963Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:36:56.963Z" }, "description_available": false, "entity_type": "indicates", "fromId": "53db8b3c-0fa9-4f49-ad94-7ddbe4261845", "from_id": "53db8b3c-0fa9-4f49-ad94-7ddbe4261845", "from_name": null, "from_type": "Indicator", "id": "bc71d9fc-1f6c-468f-a6e8-5f0ed3981136", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--aa4e00d0-7cf5-5c1c-942a-fab2e38764f4", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.261Z", "created_at": "2026-09-25T22:37:11.493Z", "modified": "2026-09-25T22:37:11.773Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:37:11.773Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1e66c154-5bf9-4459-a289-4958e39f1a31", "from_id": "1e66c154-5bf9-4459-a289-4958e39f1a31", "from_name": null, "from_type": "Indicator", "id": "bc7b1367-f133-4898-a2bc-676fc59dd366", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--d75444d8-4f27-5d6d-87db-7edbb53b85c1", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.173Z", "created_at": "2026-09-25T22:33:55.694Z", "modified": "2026-09-25T22:33:56.057Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:33:56.057Z" }, "description_available": false, "entity_type": "targets", "fromId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_name": "MacSync", "from_type": "Malware", "id": "beb7443c-6b63-4e41-96b3-32ed4f0315f5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--16432c68-c723-5f30-b2f2-8826e97d50c9", "toId": "2f8a4ddc-793d-43b9-a7fc-a29d93a0db1d", "to_id": "2f8a4ddc-793d-43b9-a7fc-a29d93a0db1d", "to_name": "Canada", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T18:54:44.601Z", "created_at": "2026-03-04T09:23:01.029Z", "modified": "2026-03-04T09:23:01.276Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-04T09:23:01.276Z" }, "description_available": false, "entity_type": "targets", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "bf2144f5-e630-4006-be00-0e09c2901f14", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--152d071c-9b7e-5a89-9830-cd1b184c6763", "toId": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_id": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_name": "Finance", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.262Z", "created_at": "2026-09-25T22:37:12.091Z", "modified": "2026-09-25T22:37:12.552Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:37:12.552Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1e66c154-5bf9-4459-a289-4958e39f1a31", "from_id": "1e66c154-5bf9-4459-a289-4958e39f1a31", "from_name": null, "from_type": "Indicator", "id": "c06e2f03-5e5c-42cb-aad3-937b9e512bd0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--35c459ea-87fa-5ecb-8125-0b48f3cc8575", "toId": "65de75f2-577f-475e-9394-05450cc05a45", "to_id": "65de75f2-577f-475e-9394-05450cc05a45", "to_name": "LummaC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.321Z", "created_at": "2026-09-25T22:38:30.023Z", "modified": "2026-09-25T22:38:30.299Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:38:30.299Z" }, "description_available": false, "entity_type": "indicates", "fromId": "05249b1e-20c2-4d0c-8b6b-042029a7e4e6", "from_id": "05249b1e-20c2-4d0c-8b6b-042029a7e4e6", "from_name": null, "from_type": "Indicator", "id": "c327f416-2206-4e1c-9b6a-4488d95a2468", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--5544c8a4-39aa-5b62-8654-56ceb2a4386d", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T20:29:11.712Z", "created_at": "2026-03-24T16:25:55.825Z", "modified": "2026-03-24T16:26:03.479Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-24T16:26:03.479Z" }, "description_available": false, "entity_type": "targets", "fromId": "65de75f2-577f-475e-9394-05450cc05a45", "from_id": "65de75f2-577f-475e-9394-05450cc05a45", "from_name": "LummaC2", "from_type": "Malware", "id": "c442745e-8b67-44d8-a0cd-68f159484326", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--7c661a74-788d-5226-a1ee-65a170636434", "toId": "28acec63-0804-49d2-95fa-8beb12f12b33", "to_id": "28acec63-0804-49d2-95fa-8beb12f12b33", "to_name": "France", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.202Z", "created_at": "2026-09-25T22:36:08.607Z", "modified": "2026-09-25T22:36:12.196Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:36:12.196Z" }, "description_available": false, "entity_type": "based-on", "fromId": "46793d9f-2092-4522-909c-16fbded66c1b", "from_id": "46793d9f-2092-4522-909c-16fbded66c1b", "from_name": null, "from_type": "Indicator", "id": "c47e695a-2f73-44f2-ae7b-f249541e1695", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--47602ac4-2113-5fa3-bc42-d949854e8414", "toId": "da664471-b741-4ff7-954a-0dca535eae08", "to_id": "da664471-b741-4ff7-954a-0dca535eae08", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.062Z", "created_at": "2026-01-18T14:40:00.031Z", "modified": "2026-01-18T14:40:00.787Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:40:00.787Z" }, "description_available": true, "entity_type": "located-at", "fromId": "402b2086-638d-4a79-88bb-c79acff485d8", "from_id": "402b2086-638d-4a79-88bb-c79acff485d8", "from_name": "Australia", "from_type": "Country", "id": "c5060747-c183-4928-8cfd-b21087a98ea5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--9d7fbfbe-66b8-5b09-8851-72dc8a97d47e", "toId": "2730372a-ef6c-4210-bc27-805102dc639f", "to_id": "2730372a-ef6c-4210-bc27-805102dc639f", "to_name": "Australia and New Zealand", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:23:53.580Z", "created_at": "2026-03-09T14:48:17.577Z", "modified": "2026-03-09T14:48:19.348Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-09T14:48:19.348Z" }, "description_available": false, "entity_type": "targets", "fromId": "65de75f2-577f-475e-9394-05450cc05a45", "from_id": "65de75f2-577f-475e-9394-05450cc05a45", "from_name": "LummaC2", "from_type": "Malware", "id": "c6ee29f8-1ef4-4aca-b979-f0d7fae73c49", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--4931c5c7-8cf9-5ac1-8630-1e7a2abe3b32", "toId": "f2fc791f-b777-4d8f-87a6-5e87abeec776", "to_id": "f2fc791f-b777-4d8f-87a6-5e87abeec776", "to_name": "United Kingdom of Great Britain and Northern Ireland", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.156Z", "created_at": "2026-09-25T22:33:47.956Z", "modified": "2026-09-25T22:33:48.322Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:33:48.322Z" }, "description_available": false, "entity_type": "targets", "fromId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_name": "MacSync", "from_type": "Malware", "id": "c745502b-ed43-4c7c-b2fb-b96a984c0b6b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--aecafe53-08dd-5c76-80a6-f0481b4f261f", "toId": "86dceb6c-5d18-4956-8792-cf2d15d37ae5", "to_id": "86dceb6c-5d18-4956-8792-cf2d15d37ae5", "to_name": "Defense", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.285Z", "created_at": "2026-09-25T22:37:40.640Z", "modified": "2026-09-25T22:37:40.880Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:37:40.880Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6153c912-e546-4292-b04a-e680a4e39367", "from_id": "6153c912-e546-4292-b04a-e680a4e39367", "from_name": null, "from_type": "Indicator", "id": "c7b7b5d1-bd53-4426-95b1-302fce759d48", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--03840821-46ca-511f-a521-ff186e364a0e", "toId": "65de75f2-577f-475e-9394-05450cc05a45", "to_id": "65de75f2-577f-475e-9394-05450cc05a45", "to_name": "LummaC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.207Z", "created_at": "2026-09-25T22:36:08.658Z", "modified": "2026-09-25T22:36:12.198Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:36:12.198Z" }, "description_available": false, "entity_type": "based-on", "fromId": "1e66c154-5bf9-4459-a289-4958e39f1a31", "from_id": "1e66c154-5bf9-4459-a289-4958e39f1a31", "from_name": null, "from_type": "Indicator", "id": "cb341b9a-6296-4fff-8197-4e3727fa3a21", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--bae2a569-f2eb-5de2-ad37-df15ab53e36c", "toId": "40b040e5-25fc-4c6a-8115-b018daedcce1", "to_id": "40b040e5-25fc-4c6a-8115-b018daedcce1", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-03-18T09:15:54.833Z", "created_at": "2026-04-24T18:37:22.213Z", "modified": "2026-04-24T18:37:22.838Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-04-24T18:37:22.838Z" }, "description_available": false, "entity_type": "targets", "fromId": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_name": "Stealc", "from_type": "Malware", "id": "d0590f51-f5b7-4a6f-ae20-46c104a8df2f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--ad3c092b-e299-5a28-b3c1-f0a2a5b75ea1", "toId": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_id": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_name": "Finance", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.297Z", "created_at": "2026-09-25T22:38:10.498Z", "modified": "2026-09-25T22:38:11.446Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:38:11.446Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0284f8d3-8d1e-4099-b425-1dfdf3756b24", "from_id": "0284f8d3-8d1e-4099-b425-1dfdf3756b24", "from_name": null, "from_type": "Indicator", "id": "d0a50768-e04d-498d-b18b-3a355d1bcdf0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--df17911a-a356-5a27-9b71-7521d2eae4d5", "toId": "90740c7b-0969-4359-a452-1a4775ff4af2", "to_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "to_name": "Stealc", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T17:58:00.420Z", "created_at": "2026-02-22T23:47:10.044Z", "modified": "2026-02-22T23:47:13.576Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-02-22T23:47:13.576Z" }, "description_available": false, "entity_type": "targets", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "d1dd24b0-1667-40de-b45b-13d101696bed", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--621c5cd6-dbc3-5cac-a518-1c5dd8f16a64", "toId": "6926835d-28e0-4787-97c9-699d0375b12b", "to_id": "6926835d-28e0-4787-97c9-699d0375b12b", "to_name": "India", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T18:54:44.727Z", "created_at": "2026-03-04T09:24:12.102Z", "modified": "2026-03-04T09:24:12.277Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-04T09:24:12.277Z" }, "description_available": false, "entity_type": "targets", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "d3f3daa7-56c4-4b25-9faa-b69df895c852", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--fa9e18ef-7e36-525d-851f-2a9833a26448", "toId": "2f8a4ddc-793d-43b9-a7fc-a29d93a0db1d", "to_id": "2f8a4ddc-793d-43b9-a7fc-a29d93a0db1d", "to_name": "Canada", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.001Z", "created_at": "2026-01-18T14:37:23.360Z", "modified": "2026-01-18T14:37:23.561Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:37:23.561Z" }, "description_available": true, "entity_type": "located-at", "fromId": "2ddebcb7-f192-4ba6-9d42-5f830cffc4c8", "from_id": "2ddebcb7-f192-4ba6-9d42-5f830cffc4c8", "from_name": "Sub-Saharan Africa", "from_type": "Region", "id": "d5a551bf-8e48-4170-8e04-6f35bc3ddd9c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--2229f684-8d2e-5463-a181-1e9500b61b26", "toId": "b3cffd93-96e8-4612-9ed8-1236cbd3025c", "to_id": "b3cffd93-96e8-4612-9ed8-1236cbd3025c", "to_name": "Africa", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.158Z", "created_at": "2026-09-25T22:33:49.607Z", "modified": "2026-09-25T22:33:50.071Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:33:50.071Z" }, "description_available": false, "entity_type": "targets", "fromId": "65de75f2-577f-475e-9394-05450cc05a45", "from_id": "65de75f2-577f-475e-9394-05450cc05a45", "from_name": "LummaC2", "from_type": "Malware", "id": "d636052c-a29b-4ed0-9ecb-eff22f118494", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--ac7f2ce1-4dfb-557e-b2bc-9e3be1390e66", "toId": "86dceb6c-5d18-4956-8792-cf2d15d37ae5", "to_id": "86dceb6c-5d18-4956-8792-cf2d15d37ae5", "to_name": "Defense", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.171Z", "created_at": "2026-09-25T22:33:52.035Z", "modified": "2026-09-25T22:33:52.348Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:33:52.348Z" }, "description_available": false, "entity_type": "targets", "fromId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_name": "MacSync", "from_type": "Malware", "id": "d7b8be49-0466-4995-9eed-1acd0938bd59", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--d1d6b792-0c80-5516-91ae-9ea1577db301", "toId": "3460c7f0-1521-461b-af64-2de060664fb1", "to_id": "3460c7f0-1521-461b-af64-2de060664fb1", "to_name": "United States of America", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-03-18T09:18:14.129Z", "created_at": "2026-04-25T00:37:43.648Z", "modified": "2026-04-25T00:37:58.332Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-04-25T00:37:58.332Z" }, "description_available": false, "entity_type": "targets", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "d832628a-c697-40ca-b0c6-a72bb30624c4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--d60dbf23-2aef-5b3f-b35f-259caa1397ce", "toId": "f2fc791f-b777-4d8f-87a6-5e87abeec776", "to_id": "f2fc791f-b777-4d8f-87a6-5e87abeec776", "to_name": "United Kingdom of Great Britain and Northern Ireland", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T18:15:57.007Z", "created_at": "2026-02-26T09:06:51.540Z", "modified": "2026-03-16T13:03:34.000Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-16T13:03:34.000Z" }, "description_available": false, "entity_type": "targets", "fromId": "65de75f2-577f-475e-9394-05450cc05a45", "from_id": "65de75f2-577f-475e-9394-05450cc05a45", "from_name": "LummaC2", "from_type": "Malware", "id": "d9b60063-fd6c-4042-bc70-b89b5600be09", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--c5695dbc-6daa-5497-be7c-117869aa4580", "toId": "25243a50-06ec-4c1b-8fb2-6a96793e8404", "to_id": "25243a50-06ec-4c1b-8fb2-6a96793e8404", "to_name": "Technologies", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T20:29:11.711Z", "created_at": "2026-03-24T16:25:43.775Z", "modified": "2026-03-24T16:25:50.617Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-24T16:25:50.617Z" }, "description_available": false, "entity_type": "targets", "fromId": "65de75f2-577f-475e-9394-05450cc05a45", "from_id": "65de75f2-577f-475e-9394-05450cc05a45", "from_name": "LummaC2", "from_type": "Malware", "id": "da82b3dd-ec4f-431c-9402-8292031eab78", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--8e69ea14-f672-5455-b2ad-d895c3823d5f", "toId": "f571f0ef-816b-43b9-98be-7dd1ec907646", "to_id": "f571f0ef-816b-43b9-98be-7dd1ec907646", "to_name": "British Indian Ocean Territory", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.035Z", "created_at": "2026-01-18T14:38:41.111Z", "modified": "2026-01-18T14:38:41.841Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:41.841Z" }, "description_available": true, "entity_type": "located-at", "fromId": "3460c7f0-1521-461b-af64-2de060664fb1", "from_id": "3460c7f0-1521-461b-af64-2de060664fb1", "from_name": "United States of America", "from_type": "Country", "id": "daee60ed-495b-4626-8967-6a667c789917", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--98d1ce2f-0759-5c90-a6e9-100a3a2299a7", "toId": "3f84bc21-010c-46a3-bad3-432dcd70f556", "to_id": "3f84bc21-010c-46a3-bad3-432dcd70f556", "to_name": "Northern America", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.250Z", "created_at": "2026-09-25T22:36:55.038Z", "modified": "2026-09-25T22:36:55.503Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:36:55.503Z" }, "description_available": false, "entity_type": "indicates", "fromId": "53db8b3c-0fa9-4f49-ad94-7ddbe4261845", "from_id": "53db8b3c-0fa9-4f49-ad94-7ddbe4261845", "from_name": null, "from_type": "Indicator", "id": "dc8e76fe-cb97-4f55-b233-6a76f3d1fc09", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--0079254a-fd12-5291-997f-4608b9df91ea", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.239Z", "created_at": "2026-09-25T22:36:35.514Z", "modified": "2026-09-25T22:36:35.951Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:36:35.951Z" }, "description_available": false, "entity_type": "indicates", "fromId": "46793d9f-2092-4522-909c-16fbded66c1b", "from_id": "46793d9f-2092-4522-909c-16fbded66c1b", "from_name": null, "from_type": "Indicator", "id": "df51d95b-9a4c-4bfa-aa66-684aee726884", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--3ce8702b-8963-5149-99e0-b63f2ace3c46", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.154Z", "created_at": "2026-09-25T22:33:48.897Z", "modified": "2026-09-25T22:33:49.510Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:33:49.510Z" }, "description_available": false, "entity_type": "targets", "fromId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_name": "MacSync", "from_type": "Malware", "id": "df55f29a-a0fc-4746-b6f9-a9e3fe5bf482", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--2d0bedab-7f2e-55d0-95d2-1c81a68bfe5e", "toId": "25243a50-06ec-4c1b-8fb2-6a96793e8404", "to_id": "25243a50-06ec-4c1b-8fb2-6a96793e8404", "to_name": "Technologies", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:24:52.925Z", "created_at": "2026-08-09T19:31:01.032Z", "modified": "2026-08-09T19:31:01.958Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-08-09T19:31:01.958Z" }, "description_available": false, "entity_type": "targets", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "e29c3029-eddd-41c5-a0b1-61d94e11d98f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--b3b5cca5-3a2b-5ccf-8fd3-03747269bc34", "toId": "1dd71a00-5740-4802-b05e-d76e46b5469c", "to_id": "1dd71a00-5740-4802-b05e-d76e46b5469c", "to_name": "Singapore", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:40:09.982Z", "created_at": "2026-08-11T04:45:53.331Z", "modified": "2026-08-11T04:45:54.018Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-08-11T04:45:54.018Z" }, "description_available": false, "entity_type": "targets", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "e343317c-3dfd-4f7a-89e8-ac52da304b78", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--3e53f56a-cbcd-5d75-8532-f79e7e9a223f", "toId": "86dceb6c-5d18-4956-8792-cf2d15d37ae5", "to_id": "86dceb6c-5d18-4956-8792-cf2d15d37ae5", "to_name": "Defense", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.189Z", "created_at": "2026-09-25T22:34:17.146Z", "modified": "2026-09-25T22:34:25.522Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:34:25.522Z" }, "description_available": false, "entity_type": "targets", "fromId": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_name": "Stealc", "from_type": "Malware", "id": "ec0d8504-35c8-4de2-8f9d-d3a4727c02dc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--2dfed4d9-f416-55a3-a567-d032a2d34c07", "toId": "7a370bce-880b-477d-b87c-2fc78164dde9", "to_id": "7a370bce-880b-477d-b87c-2fc78164dde9", "to_name": "Japan", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.251Z", "created_at": "2026-09-25T22:37:05.778Z", "modified": "2026-09-25T22:37:06.196Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:37:06.196Z" }, "description_available": false, "entity_type": "indicates", "fromId": "53db8b3c-0fa9-4f49-ad94-7ddbe4261845", "from_id": "53db8b3c-0fa9-4f49-ad94-7ddbe4261845", "from_name": null, "from_type": "Indicator", "id": "ed0ba3f4-4650-48b9-a306-dedd1a9b6857", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--73df0142-5635-5879-850c-de1608c4a14a", "toId": "90740c7b-0969-4359-a452-1a4775ff4af2", "to_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "to_name": "Stealc", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:23:53.583Z", "created_at": "2026-03-09T14:48:21.422Z", "modified": "2026-03-09T14:48:21.711Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-09T14:48:21.711Z" }, "description_available": false, "entity_type": "targets", "fromId": "65de75f2-577f-475e-9394-05450cc05a45", "from_id": "65de75f2-577f-475e-9394-05450cc05a45", "from_name": "LummaC2", "from_type": "Malware", "id": "eefd4fb1-6a5f-4988-a51f-a1791850bcbb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--1fd77313-adca-5aa9-900b-39b49a1386d8", "toId": "7a370bce-880b-477d-b87c-2fc78164dde9", "to_id": "7a370bce-880b-477d-b87c-2fc78164dde9", "to_name": "Japan", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T20:29:11.708Z", "created_at": "2026-03-24T16:25:08.830Z", "modified": "2026-03-24T16:25:09.878Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-24T16:25:09.878Z" }, "description_available": false, "entity_type": "targets", "fromId": "65de75f2-577f-475e-9394-05450cc05a45", "from_id": "65de75f2-577f-475e-9394-05450cc05a45", "from_name": "LummaC2", "from_type": "Malware", "id": "f0733a15-472a-4a5f-8022-471afb982dce", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--b207a8e5-526c-5dee-a015-6eed890d7fd2", "toId": "402b2086-638d-4a79-88bb-c79acff485d8", "to_id": "402b2086-638d-4a79-88bb-c79acff485d8", "to_name": "Australia", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.158Z", "created_at": "2026-09-25T22:33:48.325Z", "modified": "2026-09-25T22:33:48.835Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:33:48.835Z" }, "description_available": false, "entity_type": "targets", "fromId": "65de75f2-577f-475e-9394-05450cc05a45", "from_id": "65de75f2-577f-475e-9394-05450cc05a45", "from_name": "LummaC2", "from_type": "Malware", "id": "f1f35962-a6bf-4801-a045-14227bf57869", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--e63559a4-1764-5a5f-85a6-9bda355f73bb", "toId": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_id": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_name": "Government and administrations", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.332Z", "created_at": "2026-09-25T22:38:55.647Z", "modified": "2026-09-25T22:38:55.901Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:38:55.901Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ef94c79b-d454-4cb3-bf81-7da9cdc5ef8e", "from_id": "ef94c79b-d454-4cb3-bf81-7da9cdc5ef8e", "from_name": null, "from_type": "Indicator", "id": "f242c3f5-2226-466c-87ed-08f87f779d0e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--4fa01088-b723-50b8-8c65-5b85aaf766c1", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-03-18T09:15:54.831Z", "created_at": "2026-04-24T18:37:17.230Z", "modified": "2026-04-24T18:37:17.860Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-04-24T18:37:17.860Z" }, "description_available": false, "entity_type": "targets", "fromId": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_name": "Stealc", "from_type": "Malware", "id": "f344c2f6-b98a-4725-9a76-892c2bdb41a8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--2de3c766-3622-52c2-9864-6f5c8f52905c", "toId": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_id": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_name": "Government and administrations", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.343Z", "created_at": "2026-09-25T22:38:57.005Z", "modified": "2026-09-25T22:38:57.228Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:38:57.228Z" }, "description_available": false, "entity_type": "indicates", "fromId": "57747752-926b-47ee-90bf-07f8084c6ca2", "from_id": "57747752-926b-47ee-90bf-07f8084c6ca2", "from_name": null, "from_type": "Indicator", "id": "f3f2b0b9-8261-46bb-8cd3-eaeb653869bc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--c9a3a6a2-fa08-55f2-8f15-5c903f0a3443", "toId": "65de75f2-577f-475e-9394-05450cc05a45", "to_id": "65de75f2-577f-475e-9394-05450cc05a45", "to_name": "LummaC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.226Z", "created_at": "2026-09-25T22:36:24.125Z", "modified": "2026-09-25T22:36:25.868Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:36:25.868Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f70940b5-5820-41e9-ae9b-5932d562dda4", "from_id": "f70940b5-5820-41e9-ae9b-5932d562dda4", "from_name": null, "from_type": "Indicator", "id": "f7802f0e-0ed1-47e6-b2ed-c3b18122caa1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--ad6dd63c-7f3c-5529-bd3c-12afcfc8594e", "toId": "65de75f2-577f-475e-9394-05450cc05a45", "to_id": "65de75f2-577f-475e-9394-05450cc05a45", "to_name": "LummaC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:27.172Z", "created_at": "2026-09-25T22:33:53.234Z", "modified": "2026-09-25T22:33:54.928Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:33:54.928Z" }, "description_available": false, "entity_type": "targets", "fromId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_name": "MacSync", "from_type": "Malware", "id": "f7f0b968-f616-4b15-8910-c7674ecb2f88", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--70842fc9-38dd-5bf2-aee6-c8c510232f9f", "toId": "f571f0ef-816b-43b9-98be-7dd1ec907646", "to_id": "f571f0ef-816b-43b9-98be-7dd1ec907646", "to_name": "British Indian Ocean Territory", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.043Z", "created_at": "2026-01-18T14:38:57.608Z", "modified": "2026-01-18T14:38:58.126Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:58.126Z" }, "description_available": true, "entity_type": "located-at", "fromId": "0edd7cee-c750-4a70-82dc-a493fef311a8", "from_id": "0edd7cee-c750-4a70-82dc-a493fef311a8", "from_name": "Southern Asia", "from_type": "Region", "id": "fc94576d-aa18-45ec-b2d5-c5fc89a3a2ba", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--a6d11fc4-a24e-5137-a9f8-f178f9ed60de", "toId": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "to_id": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "to_name": "Asia", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.052Z", "created_at": "2026-01-18T14:39:26.819Z", "modified": "2026-01-18T14:39:27.423Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:27.423Z" }, "description_available": true, "entity_type": "located-at", "fromId": "d5563518-7ebb-46ed-a037-525564906cd9", "from_id": "d5563518-7ebb-46ed-a037-525564906cd9", "from_name": "Northern Europe", "from_type": "Region", "id": "fdcf6f17-867b-42f3-aecc-004afc94a3a6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--44bf8f8f-17e0-5590-93ed-b598e74291a6", "toId": "6e23d1d1-9fea-43f8-a01c-f1b416f6e558", "to_id": "6e23d1d1-9fea-43f8-a01c-f1b416f6e558", "to_name": "Europe", "to_type": "Region" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "drivinguber[.]com", "description_available": false, "object_id": "f70940b5-5820-41e9-ae9b-5932d562dda4", "object_ids": [ "53cb35b0-94d2-4d7a-9c08-fe0aa0430190", "f70940b5-5820-41e9-ae9b-5932d562dda4" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "f70940b5-5820-41e9-ae9b-5932d562dda4", "valid_from": "2026-07-15T16:14:15.000Z", "valid_until": "2026-10-26T07:09:23.260Z", "validity_status": "active", "value": "drivinguber.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "53cb35b0-94d2-4d7a-9c08-fe0aa0430190", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "drivinguber.com" } ], "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "type": "domain", "valid_from": "2026-07-15T16:14:15.000Z", "valid_until": "2026-10-26T07:09:23.260Z", "validity_status": "active", "value": "drivinguber.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "newsinweb[.]com", "description_available": false, "object_id": "05249b1e-20c2-4d0c-8b6b-042029a7e4e6", "object_ids": [ "05249b1e-20c2-4d0c-8b6b-042029a7e4e6", "a78caabb-ebf9-4413-9c79-523aab1ab535" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "05249b1e-20c2-4d0c-8b6b-042029a7e4e6", "valid_from": "2026-09-08T12:29:02.000Z", "valid_until": "2026-12-20T03:24:10.260Z", "validity_status": "active", "value": "newsinweb.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "a78caabb-ebf9-4413-9c79-523aab1ab535", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "newsinweb.com" } ], "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "type": "domain", "valid_from": "2026-09-08T12:29:02.000Z", "valid_until": "2026-12-20T03:24:10.260Z", "validity_status": "active", "value": "newsinweb.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "9678f71ea4cccbc3d511dc8d7f24b113", "description_available": false, "object_id": "46793d9f-2092-4522-909c-16fbded66c1b", "object_ids": [ "46793d9f-2092-4522-909c-16fbded66c1b", "da664471-b741-4ff7-954a-0dca535eae08" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "46793d9f-2092-4522-909c-16fbded66c1b", "valid_from": "2026-09-08T12:29:02.000Z", "valid_until": "2027-06-25T23:38:46.557Z", "validity_status": "active", "value": "9678f71ea4cccbc3d511dc8d7f24b113" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "da664471-b741-4ff7-954a-0dca535eae08", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "9678f71ea4cccbc3d511dc8d7f24b113" } ], "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "type": "md5", "valid_from": "2026-09-08T12:29:02.000Z", "valid_until": "2027-06-25T23:38:46.557Z", "validity_status": "active", "value": "9678f71ea4cccbc3d511dc8d7f24b113" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "de62a2f47d1c7dec2997f931a050a615", "description_available": false, "object_id": "53db8b3c-0fa9-4f49-ad94-7ddbe4261845", "object_ids": [ "53db8b3c-0fa9-4f49-ad94-7ddbe4261845", "a4a737cc-ac86-4db1-818b-92472abb1cf0" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "53db8b3c-0fa9-4f49-ad94-7ddbe4261845", "valid_from": "2026-09-08T12:29:02.000Z", "valid_until": "2027-06-25T23:38:46.557Z", "validity_status": "active", "value": "de62a2f47d1c7dec2997f931a050a615" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "a4a737cc-ac86-4db1-818b-92472abb1cf0", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "de62a2f47d1c7dec2997f931a050a615" } ], "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "type": "md5", "valid_from": "2026-09-08T12:29:02.000Z", "valid_until": "2027-06-25T23:38:46.557Z", "validity_status": "active", "value": "de62a2f47d1c7dec2997f931a050a615" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "59508d071661ea70fa5fcbe6f9e2fb72506e57df", "description_available": false, "object_id": "1e66c154-5bf9-4459-a289-4958e39f1a31", "object_ids": [ "1e66c154-5bf9-4459-a289-4958e39f1a31", "40b040e5-25fc-4c6a-8115-b018daedcce1" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "1e66c154-5bf9-4459-a289-4958e39f1a31", "valid_from": "2026-09-08T12:29:02.000Z", "valid_until": "2027-06-25T23:38:46.557Z", "validity_status": "active", "value": "59508d071661ea70fa5fcbe6f9e2fb72506e57df" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "40b040e5-25fc-4c6a-8115-b018daedcce1", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "59508d071661ea70fa5fcbe6f9e2fb72506e57df" } ], "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "type": "sha1", "valid_from": "2026-09-08T12:29:02.000Z", "valid_until": "2027-06-25T23:38:46.557Z", "validity_status": "active", "value": "59508d071661ea70fa5fcbe6f9e2fb72506e57df" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "d182eb7cba0ffa42d770d7b0d3499e49f24163a2", "description_available": false, "object_id": "24fc8125-aab7-470f-97fd-f7d447ba5095", "object_ids": [ "24fc8125-aab7-470f-97fd-f7d447ba5095", "27771ccd-ca69-4e78-b3e8-22c098f5e1b6" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "24fc8125-aab7-470f-97fd-f7d447ba5095", "valid_from": "2026-09-08T12:29:02.000Z", "valid_until": "2027-06-25T23:38:46.557Z", "validity_status": "active", "value": "d182eb7cba0ffa42d770d7b0d3499e49f24163a2" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "27771ccd-ca69-4e78-b3e8-22c098f5e1b6", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "d182eb7cba0ffa42d770d7b0d3499e49f24163a2" } ], "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "type": "sha1", "valid_from": "2026-09-08T12:29:02.000Z", "valid_until": "2027-06-25T23:38:46.557Z", "validity_status": "active", "value": "d182eb7cba0ffa42d770d7b0d3499e49f24163a2" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "9ff32f7c0108e9d27a3b491edf04827b6ca025f44db68aeadc44eeb97c9aab11", "description_available": false, "object_id": "6153c912-e546-4292-b04a-e680a4e39367", "object_ids": [ "6153c912-e546-4292-b04a-e680a4e39367", "f9a660d3-db90-4a47-868e-7c12473af38e" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "6153c912-e546-4292-b04a-e680a4e39367", "valid_from": "2026-09-08T12:29:02.000Z", "valid_until": "2027-06-25T23:38:46.557Z", "validity_status": "active", "value": "9ff32f7c0108e9d27a3b491edf04827b6ca025f44db68aeadc44eeb97c9aab11" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "f9a660d3-db90-4a47-868e-7c12473af38e", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "9ff32f7c0108e9d27a3b491edf04827b6ca025f44db68aeadc44eeb97c9aab11" } ], "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "type": "sha256", "valid_from": "2026-09-08T12:29:02.000Z", "valid_until": "2027-06-25T23:38:46.557Z", "validity_status": "active", "value": "9ff32f7c0108e9d27a3b491edf04827b6ca025f44db68aeadc44eeb97c9aab11" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "c4f70f37daae63fe47b0c92adf006f8cf50b6c522ad572a4014275cf979013a0", "description_available": false, "object_id": "0284f8d3-8d1e-4099-b425-1dfdf3756b24", "object_ids": [ "0284f8d3-8d1e-4099-b425-1dfdf3756b24", "f7c4d4ae-ca64-4c26-8f3e-236e5f24c9a1" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "0284f8d3-8d1e-4099-b425-1dfdf3756b24", "valid_from": "2026-09-08T12:29:02.000Z", "valid_until": "2027-06-25T23:38:46.557Z", "validity_status": "active", "value": "c4f70f37daae63fe47b0c92adf006f8cf50b6c522ad572a4014275cf979013a0" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "f7c4d4ae-ca64-4c26-8f3e-236e5f24c9a1", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "c4f70f37daae63fe47b0c92adf006f8cf50b6c522ad572a4014275cf979013a0" } ], "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "type": "sha256", "valid_from": "2026-09-08T12:29:02.000Z", "valid_until": "2027-06-25T23:38:46.557Z", "validity_status": "active", "value": "c4f70f37daae63fe47b0c92adf006f8cf50b6c522ad572a4014275cf979013a0" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "d182eb7cba0ffa42d770d7b0d3499e49f24163a2662494ae615713c5f04b5260", "description_available": false, "object_id": "ac3fae9c-f9c3-44bf-9e7c-14f92e81e1cd", "object_ids": [ "593f83b0-dd55-42da-92bb-4d803401255e", "ac3fae9c-f9c3-44bf-9e7c-14f92e81e1cd" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "ac3fae9c-f9c3-44bf-9e7c-14f92e81e1cd", "valid_from": "2026-09-08T12:29:02.000Z", "valid_until": "2027-06-25T23:38:46.557Z", "validity_status": "active", "value": "d182eb7cba0ffa42d770d7b0d3499e49f24163a2662494ae615713c5f04b5260" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "593f83b0-dd55-42da-92bb-4d803401255e", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "d182eb7cba0ffa42d770d7b0d3499e49f24163a2662494ae615713c5f04b5260" } ], "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "type": "sha256", "valid_from": "2026-09-08T12:29:02.000Z", "valid_until": "2027-06-25T23:38:46.557Z", "validity_status": "active", "value": "d182eb7cba0ffa42d770d7b0d3499e49f24163a2662494ae615713c5f04b5260" } ], "mentioned": [ { "confidence": 50, "evidence_id": "65de75f2-577f-475e-9394-05450cc05a45", "name": "LummaC2", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "name": "MacSync", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "name": "Stealc", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "name": "Vidar", "role": "mentionné", "type": "Malware" }, { "confidence": 100, "evidence_id": "b3cffd93-96e8-4612-9ed8-1236cbd3025c", "name": "Africa", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "0584d53c-836c-41a4-a732-0edcc5dea653", "name": "Americas", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "name": "Asia", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "2730372a-ef6c-4210-bc27-805102dc639f", "name": "Australia and New Zealand", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "5e22af61-1616-46dc-b076-551e7f99593f", "name": "Eastern Asia", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "6e23d1d1-9fea-43f8-a01c-f1b416f6e558", "name": "Europe", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "3f84bc21-010c-46a3-bad3-432dcd70f556", "name": "Northern America", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "d5563518-7ebb-46ed-a037-525564906cd9", "name": "Northern Europe", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "6c3ce996-c654-4b25-8b6d-f983459d54a6", "name": "Oceania", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "c0c50eda-edd8-4175-a851-a0bb39fc00cb", "name": "South-eastern Asia", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "0edd7cee-c750-4a70-82dc-a493fef311a8", "name": "Southern Asia", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "2ddebcb7-f192-4ba6-9d42-5f830cffc4c8", "name": "Sub-Saharan Africa", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "name": "Western Europe", "role": "mentionné", "type": "Region" } ], "mitre": { "associated_repertoire": [ { "complete": true, "relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:48:01.523Z", "created_at": "2026-03-14T10:20:06.267Z", "modified": "2026-03-14T10:20:06.591Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-14T10:20:06.591Z" }, "description_available": false, "entity_type": "uses", "fromId": "65de75f2-577f-475e-9394-05450cc05a45", "from_id": "65de75f2-577f-475e-9394-05450cc05a45", "from_name": "LummaC2", "from_type": "Malware", "id": "715fd86a-1d21-49b7-97cf-a6a4db0628c9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--73b98a83-e1d5-5c74-bfbe-ee99a9e524f1", "toId": "a6283c3d-9a76-48e7-a3ad-bdbf9e2c97b0", "to_id": "a6283c3d-9a76-48e7-a3ad-bdbf9e2c97b0", "to_name": "T1085", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:48:01.534Z", "created_at": "2026-03-14T10:20:12.932Z", "modified": "2026-03-14T10:20:13.645Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-14T10:20:13.645Z" }, "description_available": false, "entity_type": "uses", "fromId": "65de75f2-577f-475e-9394-05450cc05a45", "from_id": "65de75f2-577f-475e-9394-05450cc05a45", "from_name": "LummaC2", "from_type": "Malware", "id": "7abf4137-85af-46e1-b19f-2a2206a91b82", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--8b4bb00c-398a-533a-a602-9120ff997b81", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:23:53.533Z", "created_at": "2026-03-09T14:49:04.089Z", "modified": "2026-03-09T14:49:04.305Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-09T14:49:04.305Z" }, "description_available": false, "entity_type": "uses", "fromId": "65de75f2-577f-475e-9394-05450cc05a45", "from_id": "65de75f2-577f-475e-9394-05450cc05a45", "from_name": "LummaC2", "from_type": "Malware", "id": "fc2e387e-05ff-4fad-a917-318c540c020c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--5d49922e-4f71-5c32-967f-e995d995661e", "toId": "a7cf9af6-78a3-4678-b508-471120b152ba", "to_id": "a7cf9af6-78a3-4678-b508-471120b152ba", "to_name": "T1035", "to_type": "AttackPattern" } ], "scope": "entity-context", "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1085" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:02:56.967Z", "created_by": null, "dates": { "created": "2026-01-18T18:02:56.967Z", "created_at": "2026-01-18T18:20:24.501Z", "modified": "2026-01-18T18:20:26.536Z", "updated_at": "2026-01-18T18:20:26.536Z" }, "description_available": false, "evidence_ids": [ "715fd86a-1d21-49b7-97cf-a6a4db0628c9", "a6283c3d-9a76-48e7-a3ad-bdbf9e2c97b0" ], "external_id": "T1085", "id": "a6283c3d-9a76-48e7-a3ad-bdbf9e2c97b0", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1085", "modified": "2026-01-18T18:20:26.536Z", "name": "T1085", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1085", "id": "584a166f-e9d7-4867-b842-dcf1ba7a5aaf", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1085" } ], "relationship_ids": [ "715fd86a-1d21-49b7-97cf-a6a4db0628c9" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1085/", "via_entities": [ { "id": "65de75f2-577f-475e-9394-05450cc05a45", "name": "LummaC2", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1035" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:04:28.681Z", "created_by": null, "dates": { "created": "2026-01-18T18:04:28.681Z", "created_at": "2026-01-18T22:32:40.894Z", "modified": "2026-01-18T22:32:43.177Z", "updated_at": "2026-01-18T22:32:43.177Z" }, "description_available": false, "evidence_ids": [ "a7cf9af6-78a3-4678-b508-471120b152ba", "fc2e387e-05ff-4fad-a917-318c540c020c" ], "external_id": "T1035", "id": "a7cf9af6-78a3-4678-b508-471120b152ba", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1035", "modified": "2026-01-18T22:32:43.177Z", "name": "T1035", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1035", "id": "4d48047f-9cd1-4c60-b685-eb34453e021d", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1035" } ], "relationship_ids": [ "fc2e387e-05ff-4fad-a917-318c540c020c" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1035/", "via_entities": [ { "id": "65de75f2-577f-475e-9394-05450cc05a45", "name": "LummaC2", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "7abf4137-85af-46e1-b19f-2a2206a91b82", "ea4de683-0cad-4497-a044-65b61045d534" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "7abf4137-85af-46e1-b19f-2a2206a91b82" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "65de75f2-577f-475e-9394-05450cc05a45", "name": "LummaC2", "type": "Malware" } ] } ], "via_entity": { "id": "65de75f2-577f-475e-9394-05450cc05a45", "name": "LummaC2", "type": "Malware" } }, { "complete": true, "relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:46:54.711Z", "created_at": "2026-03-14T07:14:32.125Z", "modified": "2026-03-14T07:14:32.333Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-14T07:14:32.333Z" }, "description_available": false, "entity_type": "uses", "fromId": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_name": "Stealc", "from_type": "Malware", "id": "5822edfc-e8b6-4a12-8015-7cce9802f20a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--33d547bb-ccb8-5e46-b319-8d1919c8d8ba", "toId": "bcecf1fa-9234-4501-b5a0-e8e443ad40b6", "to_id": "bcecf1fa-9234-4501-b5a0-e8e443ad40b6", "to_name": "T1179", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:56:58.592Z", "created_at": "2026-03-15T18:07:42.224Z", "modified": "2026-03-15T18:07:42.444Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-15T18:07:42.444Z" }, "description_available": false, "entity_type": "uses", "fromId": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_name": "Stealc", "from_type": "Malware", "id": "7b64e9e4-fb0d-43cd-b60e-45bc2487a195", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--e2b3280c-0089-5496-9675-b25bf7730cf3", "toId": "49e99359-b1d6-4e62-b704-5336d333ed05", "to_id": "49e99359-b1d6-4e62-b704-5336d333ed05", "to_name": "T1086", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:56:58.591Z", "created_at": "2026-03-15T18:07:41.523Z", "modified": "2026-03-15T18:07:41.818Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-15T18:07:41.818Z" }, "description_available": false, "entity_type": "uses", "fromId": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_name": "Stealc", "from_type": "Malware", "id": "9cdabc6e-e09b-4983-b755-991d44c64964", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--f3613829-4826-5cfd-b417-57f2cb7bb5f5", "toId": "7ae6c896-c764-4c4d-bb5c-6e8c1e38d54a", "to_id": "7ae6c896-c764-4c4d-bb5c-6e8c1e38d54a", "to_name": "T1158", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:12:47.740Z", "created_at": "2026-03-07T15:38:15.419Z", "modified": "2026-03-07T15:38:16.047Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-07T15:38:16.047Z" }, "description_available": false, "entity_type": "uses", "fromId": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_name": "Stealc", "from_type": "Malware", "id": "ce3fd064-bf25-499a-a6bd-f63a473c9376", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--5079cea7-9410-53aa-ac05-40a4ca93d33d", "toId": "377ba555-5dfd-4322-a9c5-4ccce578b698", "to_id": "377ba555-5dfd-4322-a9c5-4ccce578b698", "to_name": "T1107", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T20:06:18.230Z", "created_at": "2026-03-17T19:39:53.479Z", "modified": "2026-03-17T19:39:55.389Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-17T19:39:55.389Z" }, "description_available": false, "entity_type": "uses", "fromId": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_id": "90740c7b-0969-4359-a452-1a4775ff4af2", "from_name": "Stealc", "from_type": "Malware", "id": "dbd7e78b-292f-4f86-887a-928d8c14d4bf", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--bda877c8-7f6f-5d2b-8cb1-06e5abc1077f", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" } ], "scope": "entity-context", "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1107" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:04:28.700Z", "created_by": null, "dates": { "created": "2026-01-18T18:04:28.700Z", "created_at": "2026-01-18T22:33:04.084Z", "modified": "2026-01-18T22:33:05.539Z", "updated_at": "2026-01-18T22:33:05.539Z" }, "description_available": false, "evidence_ids": [ "377ba555-5dfd-4322-a9c5-4ccce578b698", "ce3fd064-bf25-499a-a6bd-f63a473c9376" ], "external_id": "T1107", "id": "377ba555-5dfd-4322-a9c5-4ccce578b698", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1107", "modified": "2026-01-18T22:33:05.539Z", "name": "T1107", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1107", "id": "2fe56096-4b6c-4e42-9d04-6696e9f57d48", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1107" } ], "relationship_ids": [ "ce3fd064-bf25-499a-a6bd-f63a473c9376" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1107/", "via_entities": [ { "id": "90740c7b-0969-4359-a452-1a4775ff4af2", "name": "Stealc", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1086" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:06:32.388Z", "created_by": null, "dates": { "created": "2026-01-18T18:06:32.388Z", "created_at": "2026-01-19T07:30:45.408Z", "modified": "2026-01-19T07:30:46.032Z", "updated_at": "2026-01-19T07:30:46.032Z" }, "description_available": false, "evidence_ids": [ "49e99359-b1d6-4e62-b704-5336d333ed05", "7b64e9e4-fb0d-43cd-b60e-45bc2487a195" ], "external_id": "T1086", "id": "49e99359-b1d6-4e62-b704-5336d333ed05", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1086", "modified": "2026-01-19T07:30:46.032Z", "name": "T1086", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1086", "id": "9aee59f9-5700-4980-a072-87df39de0dfd", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1086" } ], "relationship_ids": [ "7b64e9e4-fb0d-43cd-b60e-45bc2487a195" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1086/", "via_entities": [ { "id": "90740c7b-0969-4359-a452-1a4775ff4af2", "name": "Stealc", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1158" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:07:22.900Z", "created_by": null, "dates": { "created": "2026-01-18T18:07:22.900Z", "created_at": "2026-01-19T09:47:16.948Z", "modified": "2026-01-19T09:47:17.272Z", "updated_at": "2026-01-19T09:47:17.272Z" }, "description_available": false, "evidence_ids": [ "7ae6c896-c764-4c4d-bb5c-6e8c1e38d54a", "9cdabc6e-e09b-4983-b755-991d44c64964" ], "external_id": "T1158", "id": "7ae6c896-c764-4c4d-bb5c-6e8c1e38d54a", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1158", "modified": "2026-01-19T09:47:17.272Z", "name": "T1158", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1158", "id": "b677469d-5319-4650-9065-e40fd5752977", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1158" } ], "relationship_ids": [ "9cdabc6e-e09b-4983-b755-991d44c64964" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1158/", "via_entities": [ { "id": "90740c7b-0969-4359-a452-1a4775ff4af2", "name": "Stealc", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1179" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:05:35.103Z", "created_by": null, "dates": { "created": "2026-01-18T18:05:35.103Z", "created_at": "2026-01-19T04:22:16.828Z", "modified": "2026-01-19T04:22:17.182Z", "updated_at": "2026-01-19T04:22:17.182Z" }, "description_available": false, "evidence_ids": [ "5822edfc-e8b6-4a12-8015-7cce9802f20a", "bcecf1fa-9234-4501-b5a0-e8e443ad40b6" ], "external_id": "T1179", "id": "bcecf1fa-9234-4501-b5a0-e8e443ad40b6", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1179", "modified": "2026-01-19T04:22:17.182Z", "name": "T1179", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1179", "id": "203db34a-72aa-4468-be6e-d704951c7f9e", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1179" } ], "relationship_ids": [ "5822edfc-e8b6-4a12-8015-7cce9802f20a" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1179/", "via_entities": [ { "id": "90740c7b-0969-4359-a452-1a4775ff4af2", "name": "Stealc", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "dbd7e78b-292f-4f86-887a-928d8c14d4bf", "ea4de683-0cad-4497-a044-65b61045d534" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "dbd7e78b-292f-4f86-887a-928d8c14d4bf" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "90740c7b-0969-4359-a452-1a4775ff4af2", "name": "Stealc", "type": "Malware" } ] } ], "via_entity": { "id": "90740c7b-0969-4359-a452-1a4775ff4af2", "name": "Stealc", "type": "Malware" } }, { "complete": true, "relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-02-17T08:30:15.771Z", "created_at": "2026-04-21T13:42:18.491Z", "modified": "2026-04-21T13:42:18.927Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-04-21T13:42:18.927Z" }, "description_available": false, "entity_type": "uses", "fromId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_name": "MacSync", "from_type": "Malware", "id": "ab5dfa3b-0b5e-4cce-961f-9df9a8fc41f7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--25ba721f-0c28-5c46-984c-a72f9063c358", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" } ], "scope": "entity-context", "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "ab5dfa3b-0b5e-4cce-961f-9df9a8fc41f7", "ea4de683-0cad-4497-a044-65b61045d534" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "ab5dfa3b-0b5e-4cce-961f-9df9a8fc41f7" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "name": "MacSync", "type": "Malware" } ] } ], "via_entity": { "id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "name": "MacSync", "type": "Malware" } }, { "complete": true, "relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-03-18T09:18:14.122Z", "created_at": "2026-04-25T00:38:20.225Z", "modified": "2026-04-25T00:38:21.265Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-04-25T00:38:21.265Z" }, "description_available": false, "entity_type": "uses", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "334a86e6-dc29-406b-84c2-e3261979d682", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--6850c2c3-7162-5383-97d2-3f3dc4caaaf6", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T18:42:00.164Z", "created_at": "2026-03-02T16:49:03.508Z", "modified": "2026-03-02T16:49:03.837Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-02T16:49:03.837Z" }, "description_available": false, "entity_type": "uses", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "be45da20-8023-4cab-856b-6dbf1f622fd5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--284446b2-7eab-5252-b491-15312ee64d78", "toId": "ec63d43c-303b-401d-acf2-f69282aa385f", "to_id": "ec63d43c-303b-401d-acf2-f69282aa385f", "to_name": "T1022", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:12:47.725Z", "created_at": "2026-03-07T15:38:03.133Z", "modified": "2026-03-07T15:38:03.525Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-07T15:38:03.525Z" }, "description_available": false, "entity_type": "uses", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "e227e9db-8b50-4dc4-a86b-91d94636e45b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--85a9df8e-c237-5220-a00b-7145d6bfe0c4", "toId": "377ba555-5dfd-4322-a9c5-4ccce578b698", "to_id": "377ba555-5dfd-4322-a9c5-4ccce578b698", "to_name": "T1107", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T18:18:00.990Z", "created_at": "2026-02-26T14:25:11.326Z", "modified": "2026-02-26T14:25:13.130Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-02-26T14:25:13.130Z" }, "description_available": false, "entity_type": "uses", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "e40da663-79dd-43d3-911a-b02e2f2a7352", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "standard_id": "relationship--1fd2087a-c237-5e58-80e2-4d31fa00722b", "toId": "37cb988d-0793-44f1-9c02-4a4c073a2f65", "to_id": "37cb988d-0793-44f1-9c02-4a4c073a2f65", "to_name": "TA0037", "to_type": "AttackPattern" } ], "scope": "entity-context", "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1107" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:04:28.700Z", "created_by": null, "dates": { "created": "2026-01-18T18:04:28.700Z", "created_at": "2026-01-18T22:33:04.084Z", "modified": "2026-01-18T22:33:05.539Z", "updated_at": "2026-01-18T22:33:05.539Z" }, "description_available": false, "evidence_ids": [ "377ba555-5dfd-4322-a9c5-4ccce578b698", "e227e9db-8b50-4dc4-a86b-91d94636e45b" ], "external_id": "T1107", "id": "377ba555-5dfd-4322-a9c5-4ccce578b698", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1107", "modified": "2026-01-18T22:33:05.539Z", "name": "T1107", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1107", "id": "2fe56096-4b6c-4e42-9d04-6696e9f57d48", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1107" } ], "relationship_ids": [ "e227e9db-8b50-4dc4-a86b-91d94636e45b" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1107/", "via_entities": [ { "id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "name": "Vidar", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "TA0037" }, "authorized_members": [], "confidence": 50, "created": "2026-01-19T17:54:05.897Z", "created_by": null, "dates": { "created": "2026-01-19T17:54:05.897Z", "created_at": "2026-02-22T11:56:32.763Z", "modified": "2026-02-22T11:56:33.001Z", "updated_at": "2026-02-22T11:56:33.001Z" }, "description_available": false, "evidence_ids": [ "37cb988d-0793-44f1-9c02-4a4c073a2f65", "e40da663-79dd-43d3-911a-b02e2f2a7352" ], "external_id": null, "id": "37cb988d-0793-44f1-9c02-4a4c073a2f65", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": null, "modified": "2026-02-22T11:56:33.001Z", "name": "TA0037", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "TA0037", "id": "d76e185f-fd09-4036-a538-7c4307ef3ae4", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/TA0037" } ], "relationship_ids": [ "e40da663-79dd-43d3-911a-b02e2f2a7352" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "tactics": [], "url": null, "via_entities": [ { "id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "name": "Vidar", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "334a86e6-dc29-406b-84c2-e3261979d682", "ea4de683-0cad-4497-a044-65b61045d534" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "334a86e6-dc29-406b-84c2-e3261979d682" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "name": "Vidar", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1022" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:06:14.577Z", "created_by": null, "dates": { "created": "2026-01-18T18:06:14.577Z", "created_at": "2026-01-19T06:44:21.850Z", "modified": "2026-01-19T06:44:22.697Z", "updated_at": "2026-01-19T06:44:22.697Z" }, "description_available": false, "evidence_ids": [ "be45da20-8023-4cab-856b-6dbf1f622fd5", "ec63d43c-303b-401d-acf2-f69282aa385f" ], "external_id": "T1022", "id": "ec63d43c-303b-401d-acf2-f69282aa385f", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1022", "modified": "2026-01-19T06:44:22.697Z", "name": "T1022", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1022", "id": "9aae6d73-a71c-4f60-bb5a-233ac9db913a", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1022" } ], "relationship_ids": [ "be45da20-8023-4cab-856b-6dbf1f622fd5" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1022/", "via_entities": [ { "id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "name": "Vidar", "type": "Malware" } ] } ], "via_entity": { "id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "name": "Vidar", "type": "Malware" } } ], "direct_techniques": [], "official_catalog": { "complete": true, "fetched_at": "2026-10-10T15:49:47Z", "schema_version": 1, "source_sha256": "6227cd8ff0e21fc6355dc871dcad6a354b0d36570d2c3b783667577320378730", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack.json", "techniques": [ { "attack_version": "1.1", "canonical_url": "https://attack.mitre.org/techniques/T1022/", "created": "2017-05-31T21:30:30.260Z", "deprecated": false, "matched": true, "mitre_id": "T1022", "modified": "2025-10-24T17:49:27.757Z", "official_name": "Data Encrypted", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0010", "name": "Exfiltration", "shortname": "exfiltration" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1560/", "mitre_id": "T1560", "official_name": "Archive Collected Data", "official_status": "active", "relationship_id": "relationship--96f5f245-a67b-4e3d-8d3f-ef2a7719a3fd", "stix_id": "attack-pattern--53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a" } ], "revoked": true, "stix_id": "attack-pattern--d54416bd-0803-41ca-870a-ce1af7c05638" }, { "attack_version": "1.1", "canonical_url": "https://attack.mitre.org/techniques/T1035/", "created": "2017-05-31T21:30:36.550Z", "deprecated": false, "matched": true, "mitre_id": "T1035", "modified": "2025-10-24T17:49:36.592Z", "official_name": "Service Execution", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0002", "name": "Execution", "shortname": "execution" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1569/002/", "mitre_id": "T1569.002", "official_name": "Service Execution", "official_status": "active", "relationship_id": "relationship--8f5086fd-1cae-4f43-8a23-e47ace0620db", "stix_id": "attack-pattern--f1951e8a-500e-4a26-8803-76d95c4554b4" } ], "revoked": true, "stix_id": "attack-pattern--f44731de-ea9f-406d-9b83-30ecbb9b4392" }, { "attack_version": "1.2", "canonical_url": "https://attack.mitre.org/techniques/T1085/", "created": "2017-05-31T21:31:06.045Z", "deprecated": false, "matched": true, "mitre_id": "T1085", "modified": "2026-04-14T22:53:14.952Z", "official_name": "Rundll32", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0002", "name": "Execution", "shortname": "execution" }, { "mitre_id": "TA0005", "name": "Stealth", "shortname": "stealth" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1218/011/", "mitre_id": "T1218.011", "official_name": "Rundll32", "official_status": "active", "relationship_id": "relationship--4d7a9d82-1400-42bd-982a-3e0e4d9396fa", "stix_id": "attack-pattern--045d0922-2310-4e60-b5e4-3302302cb3c5" } ], "revoked": true, "stix_id": "attack-pattern--62b8c999-dcc0-4755-bd69-09442d9359f5" }, { "attack_version": "1.2", "canonical_url": "https://attack.mitre.org/techniques/T1086/", "created": "2017-05-31T21:31:06.512Z", "deprecated": false, "matched": true, "mitre_id": "T1086", "modified": "2025-10-24T17:49:36.765Z", "official_name": "PowerShell", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0002", "name": "Execution", "shortname": "execution" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1059/001/", "mitre_id": "T1059.001", "official_name": "PowerShell", "official_status": "active", "relationship_id": "relationship--d948a3b2-4873-4175-be18-ddef1c20347d", "stix_id": "attack-pattern--970a3432-3237-47ad-bcca-7d8cbb217736" } ], "revoked": true, "stix_id": "attack-pattern--f4882e23-8aa7-4b12-b28a-b349c12ee9e0" }, { "attack_version": "1.1", "canonical_url": "https://attack.mitre.org/techniques/T1107/", "created": "2017-05-31T21:31:17.915Z", "deprecated": false, "matched": true, "mitre_id": "T1107", "modified": "2026-04-14T22:53:14.915Z", "official_name": "File Deletion", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0005", "name": "Stealth", "shortname": "stealth" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1070/004/", "mitre_id": "T1070.004", "official_name": "File Deletion", "official_status": "active", "relationship_id": "relationship--f6514d17-d599-4a45-93b2-a80b4aa39dde", "stix_id": "attack-pattern--d63a3fb8-9452-4e9d-a60a-54be68d5998c" } ], "revoked": true, "stix_id": "attack-pattern--56fca983-1cf1-4fd1-bda0-5e170a37ab59" }, { "attack_version": "1.1", "canonical_url": "https://attack.mitre.org/techniques/T1158/", "created": "2017-12-14T16:46:06.044Z", "deprecated": false, "matched": true, "mitre_id": "T1158", "modified": "2026-04-14T22:53:15.886Z", "official_name": "Hidden Files and Directories", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0003", "name": "Persistence", "shortname": "persistence" }, { "mitre_id": "TA0005", "name": "Stealth", "shortname": "stealth" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1564/001/", "mitre_id": "T1564.001", "official_name": "Hidden Files and Directories", "official_status": "active", "relationship_id": "relationship--12043603-b490-41fc-84ed-99e70ca4876c", "stix_id": "attack-pattern--ec8fc7e2-b356-455c-8db5-2e37be158e7d" } ], "revoked": true, "stix_id": "attack-pattern--dc27c2ec-c5f9-4228-ba57-d67b590bda93" }, { "attack_version": "1.1", "canonical_url": "https://attack.mitre.org/techniques/T1179/", "created": "2018-01-16T16:13:52.465Z", "deprecated": false, "matched": true, "mitre_id": "T1179", "modified": "2025-10-24T17:48:52.925Z", "official_name": "Hooking", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0006", "name": "Credential Access", "shortname": "credential-access" }, { "mitre_id": "TA0003", "name": "Persistence", "shortname": "persistence" }, { "mitre_id": "TA0004", "name": "Privilege Escalation", "shortname": "privilege-escalation" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1056/004/", "mitre_id": "T1056.004", "official_name": "Credential API Hooking", "official_status": "active", "relationship_id": "relationship--fb82f6d3-0e6b-4fa5-a54a-f7deb28f8324", "stix_id": "attack-pattern--f5946b5e-9408-485f-a7f7-b5efc88909b6" } ], "revoked": true, "stix_id": "attack-pattern--66f73398-8394-4711-85e5-34c8540b22a5" }, { "attack_version": "2.1", "canonical_url": "https://attack.mitre.org/techniques/T1574/002/", "created": "2020-03-13T19:41:37.908Z", "deprecated": false, "matched": true, "mitre_id": "T1574.002", "modified": "2026-04-15T22:56:43.434Z", "official_name": "DLL Side-Loading", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0002", "name": "Execution", "shortname": "execution" }, { "mitre_id": "TA0005", "name": "Stealth", "shortname": "stealth" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1574/001/", "mitre_id": "T1574.001", "official_name": "DLL", "official_status": "active", "relationship_id": "relationship--7bb3a367-c3fd-4981-8d95-8ba142f92cf2", "stix_id": "attack-pattern--2fee9321-3e71-4cf4-af24-d4d40d355b34" } ], "revoked": true, "stix_id": "attack-pattern--e64c62cf-9cd7-4a14-94ec-cdaac43ab44b" } ] } }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-08T12:29:01.266Z", "created_at": "2026-09-25T22:39:20.311Z", "modified": "2026-09-25T22:42:10.348Z", "published": "2026-09-08T12:29:01.266Z", "updated_at": "2026-09-25T22:42:10.348Z" }, "description_available": true, "id": "53c78a02-fcf3-42aa-92ea-4a56771a9fe2", "is_inferred": false, "labels": [ "applescript", "clickfix", "credential theft", "cryptocurrency wallets", "lummac2", "maas", "macos stealer", "macsync", "obfuscation", "social engineering", "stealc", "vidar" ], "lang": "en", "name": "MacSync: The Evasive macOS Stealer Exploiting ClickFix Lures", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-09-08T12:29:01.266Z", "references": [ { "external_id": null, "id": "2583e27e-909c-4624-9245-3bb76dfef11d", "source_name": "alien-vault", "url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/" }, { "external_id": "6a9fff8d4e576223ee6f9b4e", "id": "ce1db71d-30a7-4972-baea-c7d17e7edc67", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6a9fff8d4e576223ee6f9b4e" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/" }, "targets": [ { "confidence": 50, "evidence_id": "f0733a15-472a-4a5f-8022-471afb982dce", "name": "Australia", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "f7f0b968-f616-4b15-8910-c7674ecb2f88", "name": "British Indian Ocean Territory", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "d3f3daa7-56c4-4b25-9faa-b69df895c852", "name": "Canada", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "e343317c-3dfd-4f7a-89e8-ac52da304b78", "name": "Defense", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "d0590f51-f5b7-4a6f-ae20-46c104a8df2f", "name": "Finance", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "c442745e-8b67-44d8-a0cd-68f159484326", "name": "France", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "b2a51b07-88af-4b7f-9c8a-b0814b4b8981", "name": "Germany", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "f344c2f6-b98a-4725-9a76-892c2bdb41a8", "name": "Government and administrations", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "d1dd24b0-1667-40de-b45b-13d101696bed", "name": "India", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "eefd4fb1-6a5f-4988-a51f-a1791850bcbb", "name": "Japan", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "7a38ece3-30e1-4b44-b19c-c8411cc79299", "name": "Netherlands", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "e29c3029-eddd-41c5-a0b1-61d94e11d98f", "name": "Singapore", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "df55f29a-a0fc-4746-b6f9-a9e3fe5bf482", "name": "Technologies", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "d832628a-c697-40ca-b0c6-a72bb30624c4", "name": "United Kingdom of Great Britain and Northern Ireland", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "d7b8be49-0466-4995-9eed-1acd0938bd59", "name": "United States of America", "role": "cible déclarée (relation targets)", "type": "Country" } ], "techniques": [], "vulnerabilities": [] }, "report_id": "53c78a02-fcf3-42aa-92ea-4a56771a9fe2", "schema_version": 1, "selected_date": "2026-09-08", "source_url": "https://www.seqrite.com/blog/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/" }