Microsoft Defender Experts revealed more than 30 domains linked to the activity of the MacSync Stealer malware, which targets macOS devices, after analyzing its behavior on endpoints and networks rather than relying on domain names alone. The malware uses changing infrastructure to deliver the malicious payload, communicate with infected devices, and steal data, but its command-execution patterns, network requests, and file preparation remained repetitive, enabling the activity to be tracked despite domain changes.
The investigation followed earlier reports from RST Cloud that identified a limited group of domains and rapid changes in command-and-control (C2) servers after the threat was publicly disclosed. Microsoft expanded the scope of monitoring by correlating recurring behaviors during payload retrieval, server-connection logging, data collection, compression, and exfiltration.
How Does the Infection Begin?
The observed activity began with an interactive session in a macOS terminal, consistent with the ClickFix social-engineering technique, in which the user is tricked into copying commands into Terminal and running them. The attackers used curl to retrieve content from a path under their control, after which the payload was decoded or decompressed using native tools such as Base64 and gunzip.
The malware then used osascript to run Shell commands with the help of AppleScript, along with tools such as sh, cp, rm, mkdir, and killall. This sequence gives defenders a stronger signal than the download address alone, particularly when launching Terminal or zsh is followed by payload retrieval and decoding and then by a rapid external connection.
What Data Does MacSync Target?
The activity was not limited to sending periodic signals to the attackers’ servers. Microsoft observed extensive collection operations involving host and user information and running processes, as well as searches for cryptocurrency-wallet applications and local artifacts associated with Ledger and Trezor.
The malware also targeted macOS Keychain materials, Browser Safe Storage keys, browser credentials, cookies, login databases, session data, IndexedDB, LevelDB, and extension storage. The scope included Chrome, Brave, Edge, Opera, Vivaldi, Arc, Chromium, and other browsers, as well as Safari data, Apple Notes, SSH keys, AWS credentials, Kubernetes configurations, and browser profiles.
MacSync also searched for sensitive files in the Downloads, Documents, and Desktop folders, including PDF, DOCX, TXT, KEY, PEM, KDBX, OVPN, WALLET, and SEED file types.
Why Is the Changing Infrastructure Difficult to Track?
Microsoft linked the domains when several behavioral attributes aligned across process context, command lines, and network data. Key points of reference included recurring URI paths such as /curl/, /dynamic?txd=, and /gate?buildtxd=, as well as curl strings containing the options -k, -s, --max-time, and --data-binary, in addition to a macOS-specific User-Agent and API-key headers.
During data exfiltration, files were compressed into /tmp/osalogging.zip after being collected under /tmp/sync* paths. The archive was then split into parts and uploaded through HTTP PUT requests. The requests included the values upload_id, chunk_index, and total_chunks, which are indicators that can be correlated with file-creation, process, and connection events.
RST Cloud used recurring URI patterns to identify 11 additional candidate domains. It also found a fixed API-key value shared by four confirmed C2 domains, while the build token changed with each deployment. This finding shows that matching a single attribute may not be sufficient, whereas the alignment of multiple attributes reduces the risk of linking unrelated domains.
What Changes in Practice for Defenders?
The importance of the investigation lies in shifting the focus from static indicators of compromise to sequences of behavior. Domain rotation may reduce the effectiveness of blocking based on domain names or subsequent IP-address matching, but it does not necessarily eliminate the traces left by using curl, running AppleScript, accessing password stores, creating a temporary archive, and then performing a segmented upload.
- Monitor unusual Terminal and zsh sessions, especially when they begin by retrieving or decoding a payload after user interaction.
- Detect sequences that combine osascript with curl or system tools such as Base64, gunzip, cp, rm, mkdir, and killall.
- Correlate access to Keychain, browser credentials, SSH keys, and cloud credentials with the creation of archives or temporary files.
- Inspect HTTP PUT operations that use --data-binary or the values upload_id, chunk_index, and total_chunks, as well as recurring /gate paths.
- Treat new or suspicious domains as supporting indicators, while continuing to search for the request format and process context even after the domain changes.
Microsoft notes that Apple added protections in macOS 26.4 and later versions to disable ClickFix attacks. These include warnings that may prevent potentially malicious commands from being pasted into Terminal, along with XProtect checks that can block the execution of detected malicious scripts. It also recommends enabling cloud-delivered protection, network and web protection, and tamper protection in Microsoft Defender or the equivalent security product.
For Microsoft Defender XDR users, capabilities are available for detection, investigation, and response, along with threat-intelligence reports and Advanced Hunting queries that can be configured according to device scope, time period, and allowlists. These queries alone do not confirm an infection, but they provide a starting point for correlating curl behavior, request paths, and AppleScript processes with the other stages of the attack chain.