MacSync Stealer is a macOS-focused information stealer that collects credentials, cookies, SSH keys, AWS credentials, and other sensitive data. It uses ClickFix social engineering and native utilities for execution, staging data under /tmp/sync* and exfiltrating via HTTP PUT requests.