Malicious Ad for Homebrew Leads to MacSync Stealer, (Fri, May 1st)
2026-05-02T19:23:47Z•451db8ade17bb8030b68a06eef5d6bc4ac79a9532e5c1367cc136cee2031b9e9
Bitwarden CLICVE-2026-33634CanisterSprawlCheckmarx KICSHomebrewMacSyncPyPISANDCLOCKTeamPCPUNC6780X-Vercel-Set-Bypass-Cookiecredential-stealerhoneypotlibredtailmacOSmalicious-adnpmnpm-wormreconsupply-chainxinference
What happened
SANS ISC diary entries report multiple active threats: a malicious advertisement targeting Homebrew users that delivers the MacSync macOS credential stealer; honeypot-detected unusual web requests (including an X-Vercel-Set-Bypass-Cookie header) and recon probes; a guest diary warning on Libredtail; and a major supply-chain campaign update (TeamPCP) showing a 26-day pause ended with three concurrent compromises — Checkmarx KICS, Bitwarden CLI cascade, and xinference PyPI — plus identification of a CanisterSprawl npm worm. Google GTIG designated the operators as UNC6780 (credential stealer SAND
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 451db8ade17bb8030b68a06eef5d6bc4ac79a9532e5c1367cc136cee2031b9e9
- Enrichment time
- 2026-05-02T19:23:47Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.