Microsoft Tracks MacSync Stealer by Its Behavior, Not Its Domains
Microsoft correlates over 30 rotating domains to track MacSync Stealer, which steals passwords, SSH keys, wallets and AWS credentials.
50
Product
AppleScript
- Mentions · 7d0
- Mentions · 30d0
- All mentions1
- First seenAug 19, 2026
- Last mentionedAug 19, 2026
Timeline
1 articles · newest firstAppears with
- Ledgervendor · 1
- SecurityAffairsorganization · 1
- Kubernetesproduct · 1
- macOSproduct · 1
- Applevendor · 1
- curlproduct · 1
- Keychainproduct · 1
- RST Cloudorganization · 1
- MacSync Stealermalware · 1
- Microsoftvendor · 1
- AWSvendor · 1
- Microsoftorganization · 1
- Trezorvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.