Malicious Ad for Homebrew Leads to MacSync Stealer, (Fri, May 1st)
2026-05-03T07:23:46Z•234223657b45095b8f5000a5d77b5212f5e414b68940a8793fdf153a3c07777e
BitwardenCanisterSprawlCheckmarxHomebrewLibredtailMacSyncPyPISANDCLOCKTeamPCPUNC6780X-Vercel-Set-Bypass-Cookiecredential-thefthoneypotmacOSmalwarenpmreconnaissancesupply-chainthreat-intelligence
What happened
Collection of SANS ISC diary entries covering multiple active threats: a malicious ad campaign delivering the MacSync stealer via Homebrew-related lures targeting macOS users; a major TeamPCP supply-chain campaign update describing three concurrent compromises (Checkmarx KICS, Bitwarden CLI cascade, xinference PyPI), identification of a CanisterSprawl npm worm, and attribution/credential-stealer linkage to UNC6780 (SANDCLOCK). Additional observations include honeypot/recon HTTP requests (including X-Vercel-Set-Bypass-Cookie headers) and a guest diary warning about Libredtail. Operational take-
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 234223657b45095b8f5000a5d77b5212f5e414b68940a8793fdf153a3c07777e
- Enrichment time
- 2026-05-03T07:23:46Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.