Microsoft Links More Than 30 Domains to the Infrastructure of the MacSync macOS Stealer

The Microsoft Defender Experts team has linked more than 30 web domains to the infrastructure of MacSync Stealer — a macOS information-stealing malware. To attribute a given domain to this network, the researchers required several markers to match at once: process chains, command-line patterns, request paths, headers and download parameters. The August 18 report does not name the number of victims or the specific hacking group, but stresses that what was observed was active data theft, not merely “beacons.”

How the stealer works

Infection begins with a ClickFix scenario: the user is tricked into pasting and running a command in Terminal. Then curl, using the recurring path /curl/, pulls down the payload, and the standard Base64 and gunzip utilities unpack it. Next, osascript comes into play to run AppleScript.

The malware's appetite is broad: it collects data about the system and the user, the contents of the macOS keychain (Keychain), browser credentials and cookies, sessions, Apple Notes, SSH keys, AWS keys, Kubernetes configurations, browser history and files from typical user folders. All of this is dumped into /tmp/sync*, packed into /tmp/osalogging.zip, split into pieces and uploaded via HTTP PUT with the recognizable parameters upload_id, chunk_index and total_chunks. After exfiltration, the temporary archives and traces are deleted.

Overlap with earlier findings

The report builds on RST Cloud's May analysis, which described a static API key across four confirmed C2 domains and 11 more candidates found through the patterns /dynamic?txd= and /gate?buildtxd=. According to RST Cloud's observations, the hexadecimal build token changes from deployment to deployment, whereas the API key stays the same. Four domains from Microsoft's list also appeared in RST Cloud's May cluster. That said, Microsoft does not publish the static key itself and does not claim it is identical across all domains.

Defense

Microsoft advises explaining to users that they must not paste commands from unverified sources, and monitoring for suspicious Terminal sessions, payload download and decoding, as well as PUT uploads with the characteristic parameters. Apple, for its part, added protection against pasting into Terminal in macOS 26.4, blocking of commands from the clipboard and AppleScript scanning: XProtect can track the process tree, check network artifacts via Safe Browsing and block known techniques, including scripts launched directly from memory.

The publication came out less than two weeks after Microsoft's report on more than 250 frontend domains in a ClickFix campaign that distributed MacSync and Atomic Stealer behind a server-side barrier with browser fingerprinting. That said, the company does not claim it is the same infrastructure.

Source: The Hacker News