MacSync Stealer is increasing its macOS-focused theft operation via a rotating community of greater than 30 domains, utilizing secure execution and community patterns to steal credentials, browser knowledge, cloud entry keys, SSH materials, and delicate person information. <\/p>\n
Earlier analysis by RST Cloud recognized MacSync infrastructure and noticed command-and-control substitute after public disclosure. <\/p>\n
Microsoft\u2019s subsequent telemetry-led investigation linked the broader marketing campaign by correlating endpoint and community proof throughout payload supply, beaconing, assortment, staging, and lively exfiltration.<\/p>\n
Preliminary execution generally begins with a ClickFix-style social-engineering lure. Victims are persuaded to stick a command into Terminal, launching an interactive zsh shell that makes use of curl to fetch attacker-controlled content material from paths resembling The downloaded payload is then decoded or unpacked utilizing native utilities, together with Base64 and gunzip, earlier than script-driven execution begins.<\/p>\n The malware additionally abuses This mix is critical for defenders as a result of AppleScript spawning shell exercise adopted by community entry, temporary-file staging, or cleanup is a extra dependable behavioral sign than a single malicious area.<\/p>\n As soon as lively, MacSync Stealer profiles the machine and searches for high-value knowledge. <\/p>\n Microsoft Defender Specialists discovered that <\/a>whereas the infrastructure modifications quickly, the malware\u2019s recurring curl instructions, URI paths, headers, staging conduct, and chunked uploads provide defenders sturdy detection alternatives.<\/p>\n Microsoft noticed assortment focusing on macOS Keychain materials<\/a>, browser Secure Storage keys, cookies, credentials, login databases, session knowledge, IndexedDB and LevelDB shops, extension knowledge, Safari artifacts, Apple Notes, searching historical past, SSH keys, AWS credentials, Kubernetes configuration information, and information in frequent person directories. <\/p>\n The stealer additionally checks for cryptocurrency wallet-related artifacts related to Ledger and Trezor functions.<\/p>\n Quite than merely speaking with C2 servers, the malware phases stolen materials beneath paths matching Exfiltration makes use of curl with HTTP PUT requests and the These traits let defenders determine MacSync exercise even when operators abandon recognized domains. <\/p>\n Microsoft linked infrastructure via recurring paths together with \/curl\/[token]<\/code>. <\/p>\nosascript<\/code> to bridge AppleScript and shell instructions, enabling execution of utilities corresponding to sh<\/code>, cp<\/code>, rm<\/code>, mkdir<\/code>, curl<\/code>, and killall<\/code>. <\/p>\nMacSync Stealer Makes use of 30+ Rotating Domains<\/strong><\/h2>\n
![\"
MacSync](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2026\/08\/image-14.webp\")
\/tmp\/sync*<\/code>, compresses it into \/tmp\/osalogging.zip<\/code>, then splits the archive into chunks for switch. <\/p>\n--data-binary<\/code> choice. Requests embrace recurring fields corresponding to upload_id<\/code>, chunk_index<\/code>, and total_chunks<\/code>, alongside macOS Person-Agent strings and API-key headers.<\/p>\n\/curl\/<\/code>, \/dynamic?txd=<\/code>, and \/gate?buildtxd=<\/code>; curl arguments corresponding to -k<\/code>, -s<\/code>, --max-time<\/code>, and --data-binary<\/code>; and the distinctive chunked-upload parameters. <\/p>\n