Microsoft Tracks MacSync Stealer by Its Behavior, Not Its Domains
Microsoft correlates over 30 rotating domains to track MacSync Stealer, which steals passwords, SSH keys, wallets and AWS credentials.
50
Organization
RST Cloud
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenAug 19, 2026
- Last mentionedAug 19, 2026
Timeline
2 articles · newest firstMicrosoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure
Microsoft links 30+ rotating domains to the MacSync macOS infostealer, confirming active credential and file exfiltration through chunked HTTP PUT uploads.
58
Appears with
- Microsoftvendor · 2
- Microsoftorganization · 2
- Applevendor · 2
- MacSync Stealermalware · 2
- macOSproduct · 2
- AppleScriptproduct · 1
- Trezorvendor · 1
- Ledgervendor · 1
- Keychainproduct · 1
- SecurityAffairsorganization · 1
- AWSvendor · 1
- Atomic Stealer (AMOS)malware · 1
- Kubernetesproduct · 1
- curlproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.