Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure
Microsoft links 30+ rotating domains to the MacSync macOS infostealer, confirming active credential and file exfiltration through chunked HTTP PUT uploads.
Microsoft Defender Experts correlated 30+ domains with MacSync Stealer, requiring aligned endpoint and network behaviors (process ancestry, command-line patterns, /curl/, /dynamic?txd=, and /gate?buildtxd= paths, API-key headers, chunked HTTP PUT parameters) to link infrastructure. Execution begins from an interactive zsh session consistent with ClickFix social engineering, with curl retrieving and Base64/gunzip decoding the payload, followed by collection of Keychain data, browser credentials, SSH keys, AWS credentials, Kubernetes configs, and Apple Notes. Data is zipped to /tmp/osalogging.zip, chunked, uploaded via HTTP PUT, and artifacts are deleted afterward; the analysis builds on RST Cloud's May 8 findings and overlaps with Microsoft's earlier 250+ domain ClickFix campaign distributing MacSync and Atomic Stealer (AMOS).
- Four Microsoft-listed domains also appeared in RST Cloud's May candidate cluster
- Stolen data includes Keychain, browser credentials, SSH keys, and AWS credentials
- Confirmed active data exfiltration, not just beaconing
- Apple added Terminal paste protection and AppleScript scanning in macOS 26.4
- ATT&CK
- T1059.004 Unix ShellT1555.003 Credentials from Web BrowsersT1560.001 Archive Collected DataT1070.004 File DeletionT1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- Products
- macOS
- Countries
- United States
From the original article
4 min read at thehackernews.com
Microsoft Defender Experts have linked more than 30 web domains to MacSync Stealer, a macOS-focused information stealer, after correlating recurring endpoint and network behaviors across changing infrastructure, tracing the malware from payload retrieval through data collection, staging, and exfiltration.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.