MacSync Stealer Expands Its macOS Theft Operation through 30+ Rotating Domains
In a concerning development within the realm of cybersecurity, MacSync Stealer has significantly broadened its operations, targeting macOS users through a sophisticated network comprising over 30 rotating domains. This criminal endeavor employs stable execution strategies and network patterns to stealthily capture sensitive data, including user credentials, browser data, cloud access keys, SSH materials, and other critical user files.
Prior research conducted by the threat intelligence firm RST Cloud successfully pinpointed elements of the MacSync infrastructure. Their findings highlighted the malware’s adaptive nature, notably its ability to switch command-and-control (C2) servers following public exposure. Subsequently, a detailed investigation led by Microsoft, leveraging telemetry data, revealed a comprehensive understanding of a broader campaign that included links between endpoint and network evidence across various stages: payload delivery, beaconing, data collection, staging, and the active exfiltration of sensitive information.
The initial infection vector for MacSync Stealer typically involves a social-engineering tactic reminiscent of ClickFix. Victims are lured into executing a command within their Terminal, which triggers an interactive zsh shell. This shell utilizes the curl command to retrieve malicious content from paths that appear legitimate, such as /curl/[token]. Once the payload is downloaded, it is decoded and unpacked with the help of native macOS utilities like Base64 and gunzip, paving the way for the execution of a pre-defined script.
Adding another layer to its capabilities, the malware takes advantage of Apple’s scripting tool, osascript, enabling seamless integration between AppleScript and shell commands. This functionality allows for the execution of various utilities, including sh, cp, rm, mkdir, and curl. The implications of this method are notable for cybersecurity defenders, as the behavior of spawning shell activity from AppleScript, followed by network access and temporary file staging, presents a more reliable signal for malicious behavior than simply monitoring a single domain.
Once fully operational, MacSync Stealer begins profiling the infected device, systematically searching for high-value data. Microsoft’s Defender Experts have found that, despite the infrastructure’s rapid evolution, the malware’s consistent use of curl commands, URI paths, headers, and staging behaviors presents robust opportunities for threat detection. Among the data targeted are critical materials from macOS Keychain, browser Safe Storage keys, session data, IndexedDB and LevelDB stores, Apple Notes, browsing history, and various cloud-related credentials, including those associated with AWS and Kubernetes.
Furthermore, the malware is designed to identify cryptocurrency wallet-related artifacts, specifically targeting files linked to Ledger and Trezor applications. Not merely limited to direct communication with its C2 servers, MacSync Stealer first stages the stolen data in temporary directories under slash-tmp/sync*, compresses it into tmp/osalogging.zip, and subsequently divides the archive into multiple chunks for transmission.
For exfiltration, the malware utilizes curl with HTTP PUT requests, incorporating options like --data-binary. The requests sent during this process often contain recurring fields, including upload_id, chunk_index, and total_chunks, along with identifiers such as macOS user-agent strings and embedded API-key headers. These consistent patterns enable defenders to identify MacSync activity even when operators frequently abandon known domains in favor of new ones.
The investigation also unveiled a potential connection through recurring paths seen in requests, including /curl/, /dynamic?txd=, and /gate?buildtxd=, alongside curl-specific arguments such as -k, -s, --max-time, and distinctive chunked-upload parameters. RST Cloud’s research similarly identified eleven candidate domains linked to this malicious activity through URI behavior. Their scrutiny revealed a static API-key value shared across four confirmed C2 domains, despite the use of rotating build tokens.
This campaign serves as a critical reminder of the inadequacy of relying solely on static indicators of compromise (IOCs) when dealing with rapidly evolving threats in the macOS landscape. Security teams are advised to correlate activities such as interactive Terminal or zsh session usages, curl-based downloads, and sensitive credential-store accesses to detect signs of compromise. Moreover, monitoring for the deletion of temporary archives and staging directories immediately following data uploads is crucial, as MacSync often attempts to erase evidence of its activities.
In response to these threats, Apple has implemented safeguards in macOS 26.4 and later, introducing Terminal paste warnings intended to thwart potentially harmful commands. Additionally, the company’s XProtect environment features capabilities that can prevent malicious scripts from executing.
To better equip against these threats, enterprises are encouraged to pair Apple’s built-in protections with cloud-delivered endpoint security solutions, ongoing web filtering, and tamper protection processes. By integrating these layers of security, organizations can significantly reduce the likelihood of users executing unauthorized commands in the Terminal that could lead to severe data breaches.
In summary, MacSync Stealer’s advancement through a network of dynamic domains underscores the need for enhanced vigilance and adaptive defense mechanisms in cybersecurity strategies aimed at protecting sensitive data within macOS environments.