Dissecting a Multi-Stage macOS Infostealer

Summary I recently obtained a sample of a macOS infostealer that caught my attention for its operational sophistication. What initially appeared to be a straightforward Swift downloader revealed itself to be a well-engineered three-stage attack chain with some interesting anti-analysis and evasion techniques. Concurrent analysis by Jamf Threat Labs has confirmed this sample is a variant of MacSync…