Microsoft Ties 30+ Rotating Domains to MacSync Stealer Infrastructure

Microsoft Defender Experts have linked more than 30 web domains to MacSync Stealer, a macOS-focused information stealer, by correlating endpoint and network behaviors across changing infrastructure. The analysis traced the malware from payload retrieval through data collection, staging, and exfiltration, confirming active data exfiltration rather than just beaconing.

Execution begins from an interactive zsh Terminal session consistent with ClickFix social engineering, followed by curl retrieving attacker-controlled content over a recurring /curl/ path. Native utilities like Base64 and gunzip decode the payload, and osascript enables AppleScript-assisted execution. The malware collects host and user information, macOS Keychain material, browser credentials and cookies, session data, Apple Notes, SSH keys, AWS credentials, Kubernetes configurations, browser history, and sensitive files. Data is staged under /tmp/sync*, compressed into /tmp/osalogging.zip, split into chunks, and uploaded via HTTP PUT requests with recurring parameters such as upload_id, chunk_index, and total_chunks.

This disclosure builds on RST Cloud’s May 8 analysis, which documented a static API key across four confirmed C2 domains and identified 11 additional candidates via recurring URI patterns. Microsoft’s report lists 31 domains, including four that overlap with RST Cloud’s candidate cluster. Microsoft advises organizations to educate users against running Terminal commands from untrusted sources, monitor unusual shell sessions, correlate AppleScript activity with credential access, and investigate suspicious connections. Apple has also documented protections in macOS 26.4, including Terminal paste protection and AppleScript scanning.