GoPlus Security 🚦 (@GoPlusSecurity): 🚨 GoPlus Security Alert:

🚨 GoPlus Security Alert: Beware of the MacSync malware targeting #macOS users to steal crypto assets via SEO poisoning and PDF traps Recently, a highly targeted MacSync Infostealer campaign has been observed on macOS. Attackers combine SEO poisoning with ClickFix social engineering techniques to create a highly stealthy attack chain: 1. Attack Path (SEO Poisoning + Terminal Injection) Attackers manipulate search engine results to disguise malicious websites as popular PDF download pages. When victims visit these sites, a fake “I’m human” verification prompt appears, tricking users into copying and executing malicious code directly in the macOS Terminal. 2. Core Impact Once executed, the malicious loader deploys data-stealing modules that silently exfiltrate sensitive data, including: • Credentials • SSH keys • Crypto wallets 🛡️ #GoPlus Security Tips • Stay alert: Never paste or execute any “verification” or “unlock” commands from websites in Terminal. Run antivirus scans regularly. • Keep updated: Ensure your macOS is up to date to strengthen system security. • Follow the #GoPlus Anti-Phishing “4 Don’ts” — Don’t click unknown links, don’t install untrusted software, don’t sign suspicious transactions, don’t transfer funds to unverified addresses. Source report👇 https://www.cloudsek.com/blog/macsync-stealer-seo-poisoning-and-clickfix-based-macos-malware-delivery-chain