GCVE-110-OSM-2026-12393

MacSync macOS infostealer distributed via signed and notarized fake app installers (Claude Desktop, TeleGlass, RelayArc, Antigravity lures). Stage-1 shell downloader (helper.sh) inside DMG containers pulls a JSON C2 config from a jsdelivr-mirrored GitHub repo (daynotest/daynoteupd[a|t]) and stages the DayNote Mach-O payload from anchorpost13.com / download-storage.com, with beaconing/exfil to onyxsable8.com. All lure DMGs are code-signed by Developer ID Application: OSMAN ASTUR (Team ID 8T6UCTT38A). Initial intel: Jamf Threat Labs. Distribution: fake macOS app installers (Claude.app, TeleGlass.app, RelayArc.app, Antigravity.app) shipped inside signed/notarized DMG containers with Apple Developer ID "OSMAN ASTUR" (Team ID 8T6UCTT38A). DMGs contain a helper.sh stage-1 downloader that fetches an autoupd.note JSON config over cdn.jsdelivr.net from the daynotest/daynoteupd* GitHub repos. Config points to anchorpost13.com and download-storage.com to stage the DayNote Mach-O payload, which beacons to onyxsable8.com/api/metrics/run. Impersonates Anthropic's Claude Desktop via lure site https://claude-desktop.com/. All confirmed indicators (URLs, domains, DMG/Mach-O/helper.sh SHA256s, signing Team ID) recorded in verified_iocs.