Malicious Ad for Homebrew Leads to MacSync Stealer, (Fri, May 1st)
2026-05-03T01:23:50Z•07c9a614156ab11c5072b175fe7e1c34d20fb6a1d43d2e0ca6461a069556ace7
bitwarden-clicanistersprawlcheckmarx-kicscredential-stealercredential-thefthomebrewhoneypotlibredtailmacosmacsyncnpmpypireconnaissancesandclocksans_iscsecurity-podcastsupply-chainteampcpthreat-inteltrivyunc6780x-vercelxinference
What happened
SANS ISC diary feed (late Apr–May 2026) covering multiple security items: a malicious ad for Homebrew that distributes a macOS credential stealer dubbed “MacSync”; honeypot-observed reconnaissance and odd HTTP requests (including an X-Vercel-Set-Bypass-Cookie header); a guest diary warning about Libredtail; and a major TeamPCP supply-chain campaign update describing a 26-day pause ending with three concurrent compromises (Checkmarx KICS, Bitwarden CLI cascade, xinference PyPI) plus identification of a CanisterSprawl npm worm. The TeamPCP update references UNC6780 (Google GTIG designation) andS
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 07c9a614156ab11c5072b175fe7e1c34d20fb6a1d43d2e0ca6461a069556ace7
- Enrichment time
- 2026-05-03T01:23:50Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.