Microsoft Links 30+ Domains to MacSync Stealer macOS Malware

Microsoft Defender Experts have correlated more than 30 web domains to the MacSync Stealer, a macOS-focused information stealer, by tracing recurring endpoint and network behaviors across frequently rotated infrastructure. The investigation mapped the full attack chain—from payload retrieval through data collection, staging, and active exfiltration—using process ancestry, command-line patterns, request paths, headers, and upload parameters as attribution signals. Microsoft emphasized that domains were only linked after multiple behaviors aligned, and the company did not disclose a victim count or attribute the campaign to a named threat actor. "The investigation also confirmed active data exfiltration, not just beaconing," Microsoft stated in its Tuesday disclosure. Researchers tracking these domains can use a WHOIS lookup to map registration patterns and identify infrastructure clusters behind campaigns like MacSync.

The execution flow begins with an interactive zsh Terminal session consistent with ClickFix social engineering, followed by curl retrieving attacker-controlled content over a recurring /curl/ path. Native utilities including Base64 and gunzip decode and unpack the payload, which then leverages osascript for AppleScript-assisted execution alongside standard macOS and Unix tooling. MacSync harvests host and user information, macOS Keychain material, browser credentials and cookies, session data, Apple Notes, SSH keys, AWS credentials, Kubernetes configurations, browser history, and sensitive files from common user directories. With credential theft central to this stealer, users should run any exposed passwords through a password checker and confirm exposure via an email breach checker.

Stolen data is staged under /tmp/sync*, compressed into /tmp/osalogging.zip, split into multiple chunks, and uploaded via curl using HTTP PUT requests with recurring parameters including upload_id, chunk_index, and total_chunks. The malware cleans up temporary archives, staging folders, and lock files after transmission completes. The disclosure builds on RST Cloud's May 8 analysis, which documented a static API key across four confirmed C2 domains and identified 11 additional candidate domains through recurring /dynamic?txd= and /gate?buildtxd= URI patterns. A comparison by The Hacker News found that four domains Microsoft now lists—lalandscapelighting[.]com, lumenagnet[.]com, nailscanai[.]com, and numericagent[.]com—also appeared in RST Cloud's May candidate cluster. "The hex build token rotates per deployment, the api-key does not," RST Cloud noted.

Several candidate domains exhibited overlapping submission windows, which RST Cloud said was consistent with parallel C2 operation rather than strict sequential rotation between hostnames. Microsoft refers to API-key headers as a recurring MacSync trait but did not publish the static value documented by RST Cloud or confirm that the same key appears across every domain in the current set. Security teams investigating macOS-targeted stealers should validate C2 domain certificates using an SSL/TLS checker and assess outbound traffic patterns through a DNS leak test to detect unauthorized resolver communications that may indicate active infection.