Microsoft Tracks MacSync Stealer by Its Behavior, Not Its Domains
Microsoft correlates over 30 rotating domains to track MacSync Stealer, which steals passwords, SSH keys, wallets and AWS credentials.
Microsoft Defender Experts tracked MacSync Stealer, a macOS information stealer, by analyzing recurring behaviors rather than individual domains, linking over 30 domains to the campaign. The infection chain uses the ClickFix social engineering technique, tricking victims into pasting commands in Terminal, then uses curl, AppleScript, and native macOS tools to deploy the payload. The stealer targets Keychain data, browser passwords and cookies, SSH keys, AWS credentials, Kubernetes configurations, and Ledger and Trezor wallet data, staging data before exfiltration via chunked HTTP PUT requests. RST Cloud identified rapid C2 infrastructure replacement after initial public disclosure.
- ClickFix technique used to trigger execution via pasted Terminal commands
- Stealer targets Keychain, SSH keys, AWS credentials, Kubernetes configs, and crypto wallets
- Data exfiltrated through chunked HTTP PUT requests with rotating infrastructure
- Static API-key value shared across four confirmed C2 domains despite rotation
- Detection should focus on behavioral patterns like osascript chaining into network activity
- ATT&CK
- T1204.001 Malicious LinkT1059.001 Command and Scripting Interpreter: ShellT1560.001 Archive Collected DataT1041 Exfiltration Over C2 ChannelT1071.001 Web Protocols
- Malware
- MacSync Stealer
- Organizations
- MicrosoftRST CloudSecurityAffairs
From the original article
3 min read at securityaffairs.com
Microsoft tracked over 30 MacSync Stealer domains by focusing on behavioral patterns, revealing a campaign targeting passwords, keys, wallets and other data. Domain blocking is a losing game when the thing you’re blocking can register a new domain faster than you can add it to a list.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.