MacSync Stealer keeps rotating its web infrastructure, but Microsoft says its behavior is much harder to disguise.
Microsoft Defender Experts have linked more than 30 domains to MacSync Stealer, a macOS information-stealing malware, by tracking repeated endpoint and network behaviors rather than relying on domain names alone.
The investigation found activity spanning the full attack chain, from payload delivery and command-and-control (C2) communication to credential theft, data staging and exfiltration. Microsoft said it required multiple signals to align before considering a domain to be part of the same infrastructure cluster, including process ancestry, command-line activity, request paths, headers, and upload parameters.
“The investigation also confirmed active data exfiltration, not just beaconing,” Microsoft said.
The findings expand on earlier work from RST Cloud, which identified a smaller set of MacSync domains and observed infrastructure changes after public disclosure. Researchers previously found a static API key across four confirmed command-and-control domains and used recurring URI patterns to identify 11 additional candidates.
How the MacSync attack works
Microsoft said observed infections began with an interactive zsh Terminal session consistent with ClickFix, a social-engineering technique that tricks users into pasting commands into Terminal.
The malware uses curl to retrieve payloads through recurring /curl/ paths before using tools such as Base64 and gunzip to decode or unpack them. It can then use osascript to run AppleScript-assisted shell commands.
From there, MacSync searches for valuable information, including macOS Keychain material, browser credentials and cookies, SSH keys, AWS credentials, Kubernetes configurations, Apple Notes and sensitive files stored in common user directories.
The stolen information is placed under temporary /tmp/sync* paths, compressed into an archive and divided into chunks.
Those chunks are sent through HTTP PUT requests using curl, with parameters such as upload_id, chunk_index, and total_chunks. The malware then removes temporary archives and other staging artifacts, making post-infection investigation harder.
Why the behavior matters more than the domains
The biggest defensive lesson is that MacSync’s infrastructure can change faster than a conventional blocklist can keep up.
A domain can disappear or be replaced, but the malware still has to execute commands, retrieve its payload, access valuable files, create an archive, and upload the stolen data. Those steps create a behavioral fingerprint that can survive infrastructure changes.
For defenders, that makes combinations such as curl launched from an interactive shell, followed by osascript, sensitive credential access, and chunked HTTP PUT uploads far more useful than treating any single hostname as proof of compromise.
There is a tradeoff, however: tools such as curl, osascript and shell commands are legitimate on many Macs, particularly developer machines. Detection therefore needs to correlate several events rather than flagging ordinary use of those utilities.
What organizations should watch
Microsoft recommends monitoring unusual Terminal and shell activity, especially when payload retrieval or execution is followed by AppleScript activity, credential-store access, temporary archive creation, and outbound HTTP PUT traffic.
Apple has added Terminal paste protections and other controls in macOS 26.4 and later to disrupt ClickFix-style attacks, but Microsoft’s findings show why organizations still need endpoint and network visibility after initial infection.
A compromised Mac can expose far more than local files. Stolen browser sessions, SSH keys, cloud credentials, or Kubernetes configurations can provide attackers with access well beyond the original device, making behavior-based detection more useful than chasing rotating domains one at a time.
Other News: Philips and GE are investigating potential breaches after the Clop ransomware group claimed to have stolen their data in a wider campaign involving dozens of organizations.