Kiran 
A new investigation from Microsoft Defender Experts and Microsoft Security Research has pulled back the curtain on MacSync Stealer, a macOS-targeting information stealer that evades takedown attempts by constantly swapping domains while still leaving a consistent behavioral trail that defenders can hunt.
Initial reporting on MacSync Stealer came from RST Cloud, which flagged the malware based on a limited set of command-and-control domains and noted how quickly the operators rotated their infrastructure once those domains were exposed. Microsoft’s follow-up widened that lens considerably.
By correlating recurring endpoint and network behaviors rather than chasing individual indicators, Defender Experts linked more than 30 domains to the same campaign, proving the operation extends well beyond simple beaconing into active collection, staging, and exfiltration of stolen data.
MacSync Stealer Exposed
The infection chain begins with social engineering rather than a software exploit. Victims are lured into pasting or executing commands directly in Terminal, a technique known as ClickFix. Once triggered, a shell session uses curl to fetch the attacker-hosted payload, which is then decoded with Base64 and unpacked with gunzip.
From there, osascript drives AppleScript-assisted shell commands, chaining together native macOS utilities like cp, rm, mkdir, and killall to execute the next stages quietly. After execution, MacSync Stealer moves fast into discovery and credential theft.
It checks for cryptocurrency wallet software such as Ledger and Trezor, then targets Keychain material, browser Safe Storage keys, cookies, session data, SSH keys, AWS credentials, Kubernetes configs, Apple Notes, and sensitive files sitting in Downloads, Documents, and Desktop folders.
Everything gets staged under /tmp/sync* paths and compressed into an archive before it ever leaves the device. Rather than uploading data in one shot, the malware splits the compressed archive into pieces and sends them via HTTP PUT requests using curl’s --data-binary flag.
Each request carries an api-key header, a macOS User-Agent string, and tracking parameters upload_id, chunk_index, and total_chunks that persist across otherwise unrelated domains. Notably, RST Cloud found a static API-key value shared across four confirmed C2 domains, even though the build token itself rotated with each new deployment.
“The real lesson here isn’t the domain count it’s that threat actors can rotate infrastructure endlessly, but they rarely rotate their tooling habits. Every curl flag, every URI pattern like /gate?buildtxd=, is a fingerprint the operators can’t easily disguise without rebuilding their entire pipeline,” noted the research emphasizing behavior-first hunting over static IOC lists.
Static domain blocklists and retrospective indicator matching are quickly outpaced by campaigns like this one. Microsoft’s guidance centers on monitoring behavior instead: suspicious Terminal activity, AppleScript-launched shell chains, credential store access, archive creation in temp directories, and curl-based PUT uploads with chunk parameters.
Apple’s macOS 26.4 update has also introduced Terminal paste warnings and XProtect checks specifically designed to disrupt ClickFix-style lures before execution even begins.
Organizations relying on Microsoft Defender for Endpoint can apply the published advanced hunting queries targeting /curl/, /dynamic?txd=, and /gate?buildtxd= patterns to surface related activity even as the underlying domains continue to shift, turning MacSync Stealer’s own operational habits into its biggest weakness.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
