Threat reportMalwareTL-2026-1095
Verified X Ad Spreads Mac Infostealer (Atomic Stealer Variant "MacSync"/DigitStealer) via Fake DynamicLake App; ConsentFix OAuth Technique Enables Microsoft Account Takeover
Verified X Ad Spreads Mac Infostealer (Atomic Stealer (TL-2026-1095), also tracked as MacSync, is a high-severity malware campaign, first published 2026-07-03. It has no confirmed attribution, affects Apple macOS, maps to 37 MITRE ATT&CK techniques (T1005, T1027, T1036.005), and is covered by 9 detection rules and 30 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 37MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-1095
- Threat ID
- TL-2026-1095
- Also known as
- MacSync, DigitStealer, Atomic Stealer, AMOS, ConsentFix, AuthCodeFix
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, financial services, cryptocurrency, government administration, professional services, consumer
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in Verified X Ad Spreads Mac Infostealer (Atomic Stealer
Malware and tooling: Atomic Stealer (AMOS), ConsentFix / AuthCodeFix, DigitStealer, MacSync, Cloudflare Pages, Pipedream
How Verified X Ad Spreads Mac Infostealer (Atomic Stealer works
A sponsored ad placed through a verified, high-follower X (Twitter) account impersonated the Mac utility DynamicLake and redirected victims to the lookalike domain dynamicmacisland[.]com, where a ClickFix-style Terminal paste-and-run prompt installed an Atomic Stealer variant tracked by Jamf Threat Labs as "MacSync" (with related DigitStealer infections also observed); Jamf reported the ad and X removed it. The same report covers ConsentFix, a browser-native ClickFix-style OAuth phishing technique (disclosed by Push Security) that abuses the first-party Azure CLI OAuth application to steal an authorization code from a victim's existing Microsoft session, granting full account access without a password or MFA.
On 2026-07-03, Malwarebytes Labs (corroborated same-day/previous-day by 9to5Mac) reported that a sponsored advertisement running through a verified, high-follower X account impersonated DynamicLake, a legitimate macOS utility that turns a MacBook's notch into a Dynamic-Island-style widget. Clicking the ad redirected victims to dynamicmacisland[.]com, a malicious lookalike domain with no ties to the real app. The site used a ClickFix-style lure instructing visitors to open Terminal and paste an installation one-liner, which silently installed malware. Jamf Threat Labs identified the payload as a variant of Atomic Stealer (AMOS) that it tracks as "MacSync," with related infections by a second family, "DigitStealer," also observed in the same wave. Jamf reported the ad to X, which removed it. This is described as the first known instance of malware distributed through paid/sponsored advertising on X.
MacSync and DigitStealer are both mature, actively developed macOS infostealer families with a documented history predating this specific campaign, evidence the ad-borne payload sits within an established malware-as-a-service (MaaS) operation rather than a one-off tool. Jamf Threat Labs first documented DigitStealer on 2025-11-13, distributed via an unsigned disk image ("DynamicLake.dmg", containing a "Drag Into Terminal" lure) and via YouTube videos impersonating DynamicLake; a related lookalike domain, dynamiclake[.]org, was used in that wave. DigitStealer runs a six-stage chain (bash dropper with Apple-Silicon/anti-VM fingerprinting via sysctl, an AppleScript fake-password-prompt credential stealer, an obfuscated JXA browser/wallet extractor, a JXA Ledger Live ASAR-patching module, a bash LaunchAgent persistence installer, and a JXA backdoor that polls its C2 roughly every 10 seconds) and targets Chrome/Brave/Edge/Firefox credentials, Keychain, Ledger/Electrum/Exodus/Coinami wallets, OpenVPN/Tunnelblick configs, and Telegram data, while running `tccutil reset All` to strip macOS TCC privacy protections. Its C2 (goldenticketshop[.]com and diamondpickaxeforge[.]com, with infrastructure IP 80.78.25[.]205) is hosted on a single Swedish network with consistently reused .com domains and Tucows registrations, indicating a small, closely managed operator team. MacSync separately evolved from a manual ClickFix/drag-to-terminal dropper (observed via a fake-Homebrew search ad in a December 2025 SANS ISC capture, C2 glowmedaesthetics[.]com) into a code-signed and Apple-notarized Swift Mach-O binary ("runtimectl", masquerading via the state directory name "UserSyncWorker") distributed inside "zk-call-messenger-installer-3.9.2-lts.dmg" from zkcall[.]net; Apple subsequently revoked the abused Developer Team ID (GNJLS3UYZ4) after Jamf's report. That dropper rate-limits and fetches a second-stage payload from gatemaden[.]space, staging data locally (e.g. /tmp/osalogging.zip via `ditto`) before exfiltration. By May 2026, SOC Prime documented MacSync operating a rotating pool of roughly a dozen C2 domains sharing a static API key and per-build hex tokens, consistent with a MaaS model serving multiple distribution campaigns (malvertising, fake installers, and the DynamicLake/dynamicmacisland[.]com lure documented here).
The same Malwarebytes report separately covers ConsentFix (also referred to as AuthCodeFix), a browser-native, ClickFix-styled OAuth authorization-code phishing technique first disclosed by Push Security. Victims land on a compromised or SEO-poisoned high-ranking website, pass a fake Cloudflare Turnstile-style CAPTCHA that harvests their business email address and filters out bots/analysts, and are then instructed to click a "Sign in" button. This opens a genuine Microsoft/Azure login flow for the Azure CLI application (client/App ID 04b07795-8ddb-461a-bbee-02f9e1bf7b46), a first-party Microsoft application in the "Family of Client IDs" (FOCI) that is implicitly trusted and pre-consented in every tenant, so no consent-approval screen is shown. After the victim authenticates (with their own password and MFA, against the real Microsoft identity provider), Microsoft redirects to a localhost URL containing an OAuth authorization code; the victim is instructed to copy that URL and paste it into the phishing page, handing the code to the attacker, who exchanges it for access/refresh tokens and gains full account access without ever phishing a password or MFA prompt. The technique triggers only once per victim IP to evade repeat analyst visits. ConsentFix has rapidly iterated: v1 (Push Security, disclosed and analyzed through late December 2025) required manual copy-paste; v2 (credited to researcher John Hammond, documented by 2026-01-08) replaced manual copy-paste with a drag-and-drop capture of the localhost URL; and v3 (documented by BleepingComputer) automates the entire flow using Pipedream (webhook receipt and automated code-to-token exchange), Cloudflare Pages (phishing-page hosting), Hunter.io (target/email harvesting), Outlook/Tutanota accounts (operational email), DocSend (credibility-boosting PDF hosting), and a "Specter Portal" for post-exploitation access, and targets other FOCI first-party apps (Azure PowerShell, Visual Studio, Visual Studio Code, Teams) in addition to Azure CLI. As of the most recent reporting, ConsentFix v3 circulates on criminal/hacker forums with unclear confirmation of widespread criminal adoption.
Both threads share a common theme: legitimate trust surfaces — a verified social-media account and ad platform, and Microsoft's own first-party, pre-consented OAuth application — are abused to bypass the controls defenders rely on (ad-platform vetting, and password/MFA/Conditional-Access enforcement, respectively). Detection for the OAuth technique requires correlating Entra ID `SignInLogs` (interactive sign-in to a vulnerable first-party app) with `AADNonInteractiveUserSignInLogs` (the subsequent non-interactive token redemption) on shared SessionId/AppId/user within a roughly 10–600 second window, with IP/geolocation mismatch as a strong signal; mitigations include restricting FOCI first-party apps to assigned users, enforcing Conditional Access for managed/trusted devices, blocking device-code flow, and enabling Entra ID P1 Token Protection. Detection for the macOS threads centers on LaunchAgent persistence, processes/binaries named consistent with "runtimectl"/"UserSyncWorker", newly notarized/code-signed disk images from unfamiliar Developer Team IDs, ClickFix-style Terminal paste execution, and outbound connections to the identified C2 infrastructure.
MITRE ATT&CK techniques used in TL-2026-1095
Collection
T1005 Data from Local System; T1074.001 Local Data Staging; T1560.001 Archive via Utility
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1497.001 System Checks
Exfiltration
T1041 Exfiltration Over C2 Channel
Credential Access
T1056.002 GUI Input Capture; T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1555.001 Keychain
Execution
T1059.002 AppleScript; T1059.004 Unix Shell; T1204.001 Malicious Link; T1204.004 Malicious Copy and Paste
Command and Control
T1071.001 Web Protocols; T1071.004 DNS; T1102.002 Bidirectional Communication; T1105 Ingress Tool Transfer; T1132.001 Standard Encoding
Discovery
T1082 System Information Discovery; T1614.001 System Language Discovery
Initial Access
Persistence
lateral-movement
T1550.001 Application Access Token
defense-impairment
T1553.001 Gatekeeper Bypass; T1685 Disable or Modify Tools
Resource Development
T1583.001 Domains; T1583.004 Server; T1583.008 Malvertising; T1584.004 Server; T1586.001 Social Media Accounts; T1587.002 Code Signing Certificates; T1608.001 Upload Malware
Reconnaissance
Affected products and versions in Verified X Ad Spreads Mac Infostealer (Atomic Stealer
- Apple — macOS
Vulnerable versions: All macOS versions where a user can be induced to paste and execute Terminal commands - Microsoft — Entra ID / Azure CLI OAuth (First-Party FOCI Applications)
Vulnerable versions: Azure CLI (App ID 04b07795-8ddb-461a-bbee-02f9e1bf7b46); Azure PowerShell; Visual Studio; Visual Studio Code; Microsoft Teams - X Corp. — X (Twitter) Ads Platform
Vulnerable versions: Sponsored/promoted ad review process at time of campaign
Remediation for Verified X Ad Spreads Mac Infostealer (Atomic Stealer
Immediate actions
- Block identified C2 domains and IPs at DNS/proxy/firewall: dynamicmacisland[.]com, dynamiclake[.]org, zkcall[.]net, gatemaden[.]space, focusgroovy[.]com, glowmedaesthetics[.]com, goldenticketshop[.]com, diamondpickaxeforge[.]com, 80.78.25[.]205
- Report and request takedown of malicious/lookalike sponsored ads and impersonation accounts on X and other ad platforms
- Restrict Azure CLI (App ID 04b07795-8ddb-461a-bbee-02f9e1bf7b46), Azure PowerShell, Visual Studio, VS Code and Teams to assigned users only via Entra ID Enterprise Applications, and audit sign-ins to these first-party apps
- Hunt macOS endpoints for LaunchAgent persistence, processes/binaries named 'runtimectl' or referencing 'UserSyncWorker', and disk images signed with unfamiliar/newly-notarized Developer Team IDs (e.g. GNJLS3UYZ4)
- Revoke and rotate Microsoft 365/Azure sessions and refresh tokens for any user who may have completed a ConsentFix-style Terminal/localhost-URL paste flow
Workarounds
- Disable or restrict Device Code Flow via Conditional Access policy
- Train users to never paste Terminal/Run-dialog commands or localhost URLs supplied by a website into a terminal or another site
- Block or flag newly-registered lookalike domains and Cloudflare Turnstile-gated unknown domains at the web proxy
Longer-term hardening
- Deploy macOS EDR with behavioral detection for ClickFix/Terminal-paste execution chains and unsigned or newly-notarized disk-image installs
- Enforce Conditional Access requiring managed/compliant devices and trusted locations for all first-party Microsoft OAuth applications
- Deploy Microsoft Entra ID Token Protection (requires Entra ID P1) to bind tokens to trusted devices
- Deliver security-awareness training specifically covering ClickFix/paste-and-run social engineering and 'legitimate Microsoft login page' OAuth consent phishing
- Build continuous detection correlating Entra ID SignInLogs and AADNonInteractiveUserSignInLogs for shared SessionId/AppId reuse with IP or geolocation mismatch
Timeline of Verified X Ad Spreads Mac Infostealer (Atomic Stealer
- Jamf Threat Labs first reports DigitStealer, a new macOS infostealer distributed via a fake unsigned 'DynamicLake.dmg' disk image and YouTube malvertising impersonating the legitimate DynamicLake utility.
- A MacSync Stealer infection chain delivered via a malicious search ad impersonating the Homebrew package manager is captured and documented (Malware-Traffic-Analysis.net / SANS ISC), with C2 at glowmedaesthetics[.]com.
- ConsentFix (v1), a browser-native ClickFix-style OAuth authorization-code phishing technique abusing the Azure CLI first-party application, is disclosed by Push Security and analyzed by third-party researchers.
- A refined ConsentFix v2 variant, credited to researcher John Hammond, replaces the manual copy-paste step with a drag-and-drop capture of the localhost OAuth redirect URL.
- NVISO publishes detection engineering guidance (KQL correlation of Entra ID SignInLogs and AADNonInteractiveUserSignInLogs) for ConsentFix / AuthCodeFix.
- Researchers (Cyber and Ramen) expose DigitStealer's C2 infrastructure patterns, identifying consistent .com domains hosted on a single Swedish network via Tucows registrations, pointing to a small closely-managed operator team.
- SOC Prime documents MacSync Stealer operating a rotating pool of roughly a dozen command-and-control domains sharing a static API key and per-build hex tokens, consistent with a malware-as-a-service model.
- Jamf launches 'Beacon by Jamf Threat Labs,' an active Mac threat-hunting service, drawing on the same research lineage that identified MacSync and DigitStealer.
- 9to5Mac publishes companion coverage of Jamf's findings on the verified-X-account malvertising campaign distributing fake DynamicLake malware.
- Malwarebytes Labs publishes a report describing a verified X ad that redirected victims to dynamicmacisland[.]com to install MacSync/DigitStealer via a ClickFix Terminal-paste lure, and separately details the ConsentFix technique abusing Azure CLI OAuth for password-less, MFA-less Microsoft account takeover; Jamf reports the malicious ad to X and it is removed.
Sources cited for Verified X Ad Spreads Mac Infostealer (Atomic Stealer
- Verified X ad spreads Mac malware, while ConsentFix steals Microsoft accounts
- Malware found spreading through sponsored ads on X
- ConsentFix: Browser-native ClickFix hijacks OAuth grants
- New ConsentFix attack hijacks Microsoft accounts via Azure CLI
- New MacSync macOS Stealer Uses Signed App to Bypass Apple Gatekeeper
- MacSync Stealer Evolves: From ClickFix to Code-Signed Swift Malware
- DigitStealer: In-Depth Analysis of a New macOS Infostealer
- New MacSync Stealer Malware Targets macOS Users Through Digitally Signed Apps
- New Mac malware DigitStealer can steal your files and passwords
- Malicious Ad for Homebrew Leads to MacSync Stealer
- MacSync Stealer Uses Rotating C2 Infrastructure
- Tracking DigitStealer: How Operator Patterns Exposed C2 Infrastructure
- ConsentFix: How a New OAuth Attack Bypasses Microsoft Entra Conditional Access
- ConsentFix (a.k.a. AuthCodeFix): Detecting OAuth2 Authorization Code Phishing
- ConsentFix v3 attacks target Azure with automated OAuth abuse
Detection coverage for TL-2026-1095
As of 2026-07-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1095 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1095
5 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.