# Verified X Ad Spreads Mac Infostealer (Atomic Stealer Variant "MacSync"/DigitStealer) via Fake DynamicLake App; ConsentFix OAuth Technique Enables Microsoft Account Takeover

> A sponsored ad placed through a verified, high-follower X (Twitter) account impersonated the Mac utility DynamicLake and redirected victims to the lookalike domain dynamicmacisland[.]com, where a ClickFix-style Terminal paste-and-run prompt installed an Atomic Stealer variant tracked by Jamf Threat Labs as "MacSync" (with related DigitStealer infections also observed); Jamf reported the ad and X removed it. The same report covers ConsentFix, a browser-native ClickFix-style OAuth phishing technique (disclosed by Push Security) that abuses the first-party Azure CLI OAuth application to steal an authorization code from a victim's existing Microsoft session, granting full account access without a password or MFA.

- **Published:** 2026-07-03T00:00:00Z
- **Last reviewed:** 2026-07-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1095
- **ID:** TL-2026-1095
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-07-03, Malwarebytes Labs (corroborated same-day/previous-day by 9to5Mac) reported that a sponsored advertisement running through a verified, high-follower X account impersonated DynamicLake, a legitimate macOS utility that turns a MacBook's notch into a Dynamic-Island-style widget. Clicking the ad redirected victims to dynamicmacisland[.]com, a malicious lookalike domain with no ties to the real app. The site used a ClickFix-style lure instructing visitors to open Terminal and paste an installation one-liner, which silently installed malware. Jamf Threat Labs identified the payload as a variant of Atomic Stealer (AMOS) that it tracks as "MacSync," with related infections by a second family, "DigitStealer," also observed in the same wave. Jamf reported the ad to X, which removed it. This is described as the first known instance of malware distributed through paid/sponsored advertising on X.

MacSync and DigitStealer are both mature, actively developed macOS infostealer families with a documented history predating this specific campaign, evidence the ad-borne payload sits within an established malware-as-a-service (MaaS) operation rather than a one-off tool. Jamf Threat Labs first documented DigitStealer on 2025-11-13, distributed via an unsigned disk image ("DynamicLake.dmg", containing a "Drag Into Terminal" lure) and via YouTube videos impersonating DynamicLake; a related lookalike domain, dynamiclake[.]org, was used in that wave. DigitStealer runs a six-stage chain (bash dropper with Apple-Silicon/anti-VM fingerprinting via sysctl, an AppleScript fake-password-prompt credential stealer, an obfuscated JXA browser/wallet extractor, a JXA Ledger Live ASAR-patching module, a bash LaunchAgent persistence installer, and a JXA backdoor that polls its C2 roughly every 10 seconds) and targets Chrome/Brave/Edge/Firefox credentials, Keychain, Ledger/Electrum/Exodus/Coinami wallets, OpenVPN/Tunnelblick configs, and Telegram data, while running `tccutil reset All` to strip macOS TCC privacy protections. Its C2 (goldenticketshop[.]com and diamondpickaxeforge[.]com, with infrastructure IP 80.78.25[.]205) is hosted on a single Swedish network with consistently reused .com domains and Tucows registrations, indicating a small, closely managed operator team. MacSync separately evolved from a manual ClickFix/drag-to-terminal dropper (observed via a fake-Homebrew search ad in a December 2025 SANS ISC capture, C2 glowmedaesthetics[.]com) into a code-signed and Apple-notarized Swift Mach-O binary ("runtimectl", masquerading via the state directory name "UserSyncWorker") distributed inside "zk-call-messenger-installer-3.9.2-lts.dmg" from zkcall[.]net; Apple subsequently revoked the abused Developer Team ID (GNJLS3UYZ4) after Jamf's report. That dropper rate-limits and fetches a second-stage payload from gatemaden[.]space, staging data locally (e.g. /tmp/osalogging.zip via `ditto`) before exfiltration. By May 2026, SOC Prime documented MacSync operating a rotating pool of roughly a dozen C2 domains sharing a static API key and per-build hex tokens, consistent with a MaaS model serving multiple distribution campaigns (malvertising, fake installers, and the DynamicLake/dynamicmacisland[.]com lure documented here).

The same Malwarebytes report separately covers ConsentFix (also referred to as AuthCodeFix), a browser-native, ClickFix-styled OAuth authorization-code phishing technique first disclosed by Push Security. Victims land on a compromised or SEO-poisoned high-ranking website, pass a fake Cloudflare Turnstile-style CAPTCHA that harvests their business email address and filters out bots/analysts, and are then instructed to click a "Sign in" button. This opens a genuine Microsoft/Azure login flow for the Azure CLI application (client/App ID 04b07795-8ddb-461a-bbee-02f9e1bf7b46), a first-party Microsoft application in the "Family of Client IDs" (FOCI) that is implicitly trusted and pre-consented in every tenant, so no consent-approval screen is shown. After the victim authenticates (with their own password and MFA, against the real Microsoft identity provider), Microsoft redirects to a localhost URL containing an OAuth authorization code; the victim is instructed to copy that URL and paste it into the phishing page, handing the code to the attacker, who exchanges it for access/refresh tokens and gains full account access without ever phishing a password or MFA prompt. The technique triggers only once per victim IP to evade repeat analyst visits. ConsentFix has rapidly iterated: v1 (Push Security, disclosed and analyzed through late December 2025) required manual copy-paste; v2 (credited to researcher John Hammond, documented by 2026-01-08) replaced manual copy-paste with a drag-and-drop capture of the localhost URL; and v3 (documented by BleepingComputer) automates the entire flow using Pipedream (webhook receipt and automated code-to-token exchange), Cloudflare Pages (phishing-page hosting), Hunter.io (target/email harvesting), Outlook/Tutanota accounts (operational email), DocSend (credibility-boosting PDF hosting), and a "Specter Portal" for post-exploitation access, and targets other FOCI first-party apps (Azure PowerShell, Visual Studio, Visual Studio Code, Teams) in addition to Azure CLI. As of the most recent reporting, ConsentFix v3 circulates on criminal/hacker forums with unclear confirmation of widespread criminal adoption.

Both threads share a common theme: legitimate trust surfaces — a verified social-media account and ad platform, and Microsoft's own first-party, pre-consented OAuth application — are abused to bypass the controls defenders rely on (ad-platform vetting, and password/MFA/Conditional-Access enforcement, respectively). Detection for the OAuth technique requires correlating Entra ID `SignInLogs` (interactive sign-in to a vulnerable first-party app) with `AADNonInteractiveUserSignInLogs` (the subsequent non-interactive token redemption) on shared SessionId/AppId/user within a roughly 10–600 second window, with IP/geolocation mismatch as a strong signal; mitigations include restricting FOCI first-party apps to assigned users, enforcing Conditional Access for managed/trusted devices, blocking device-code flow, and enabling Entra ID P1 Token Protection. Detection for the macOS threads centers on LaunchAgent persistence, processes/binaries named consistent with "runtimectl"/"UserSyncWorker", newly notarized/code-signed disk images from unfamiliar Developer Team IDs, ClickFix-style Terminal paste execution, and outbound connections to the identified C2 infrastructure.

## MITRE ATT&CK

- T1589.002 Email Addresses
- T1591.004 Identify Roles
- T1583.001 Domains
- T1583.004 Server
- T1583.008 Malvertising
- T1587.002 Code Signing Certificates
- T1586.001 Social Media Accounts
- T1608.001 Upload Malware
- T1584.004 Server
- T1189 Drive-by Compromise
- T1204.001 Malicious Link
- T1204.004 Malicious Copy and Paste
- T1059.004 Unix Shell
- T1059.002 AppleScript
- T1543.001 Launch Agent
- T1553.001 Gatekeeper Bypass
- T1497.001 System Checks
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1036.005 Match Legitimate Resource Name or Location
- T1555.001 Keychain
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1550.001 Application Access Token
- T1056.002 GUI Input Capture
- T1552.001 Credentials In Files
- T1082 System Information Discovery
- T1614.001 System Language Discovery
- T1005 Data from Local System
- T1074.001 Local Data Staging
- T1560.001 Archive via Utility
- T1071.001 Web Protocols
- T1071.004 DNS
- T1102.002 Bidirectional Communication
- T1105 Ingress Tool Transfer
- T1132.001 Standard Encoding
- T1041 Exfiltration Over C2 Channel

## Sources

- [Verified X ad spreads Mac malware, while ConsentFix steals Microsoft accounts](https://www.malwarebytes.com/blog/news/2026/07/verified-x-ad-spreads-mac-malware-while-consentfix-steals-microsoft-accounts)
- [Malware found spreading through sponsored ads on X](https://9to5mac.com/2026/07/02/malware-found-spreading-through-sponsored-ads-on-x/)
- [ConsentFix: Browser-native ClickFix hijacks OAuth grants](https://pushsecurity.com/blog/consentfix)
- [New ConsentFix attack hijacks Microsoft accounts via Azure CLI](https://www.bleepingcomputer.com/news/security/new-consentfix-attack-hijacks-microsoft-accounts-via-azure-cli/)
- [New MacSync macOS Stealer Uses Signed App to Bypass Apple Gatekeeper](https://thehackernews.com/2025/12/new-macsync-macos-stealer-uses-signed.html)
- [MacSync Stealer Evolves: From ClickFix to Code-Signed Swift Malware](https://www.jamf.com/blog/macsync-stealer-evolution-code-signed-swift-malware-analysis/)
- [DigitStealer: In-Depth Analysis of a New macOS Infostealer](https://www.jamf.com/blog/jtl-digitstealer-macos-infostealer-analysis/)
- [New MacSync Stealer Malware Targets macOS Users Through Digitally Signed Apps](https://gbhackers.com/macsync-stealer-malware/)
- [New Mac malware DigitStealer can steal your files and passwords](https://moonlock.com/new-mac-malware-digitstealer)
- [Malicious Ad for Homebrew Leads to MacSync Stealer](https://isc.sans.edu/diary/32942)
- [MacSync Stealer Uses Rotating C2 Infrastructure](https://socprime.com/active-threats/macsync-stealer-uses-rotating-c2-infrastructure/)
- [Tracking DigitStealer: How Operator Patterns Exposed C2 Infrastructure](https://cyberandramen.net/2026/02/16/tracking-digitstealer-how-operator-patterns-exposed-c2-infrastructure/)
- [ConsentFix: How a New OAuth Attack Bypasses Microsoft Entra Conditional Access](https://www.glueckkanja.com/en/posts/2025-12-31-vulnerability-consentfix)
- [ConsentFix (a.k.a. AuthCodeFix): Detecting OAuth2 Authorization Code Phishing](https://blog.nviso.eu/2026/01/29/consentfix-a-k-a-authcodefix-detecting-oauth2-authorization-code-phishing/)
- [ConsentFix v3 attacks target Azure with automated OAuth abuse](https://www.bleepingcomputer.com/news/security/consentfix-v3-attacks-target-azure-with-automated-oauth-abuse/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1095