Microsoft Maps 30+ Rotating Domains Used by MacSync macOS Stealer

Microsoft Defender Experts have identified more than 30 web domains linked to MacSync Stealer, a sophisticated information stealer targeting macOS. The discovery marks a strategic shift in detection; researchers moved away from static domain lists to correlate recurring network behaviors and endpoint patterns to map the malware's full lifecycle.

To uncover the infrastructure, Microsoft analyzed behavioral pivots including process ancestry, command-line patterns, and specific request paths such as /curl/, /dynamic?txd=, and /gate?buildtxd=. The team also identified specific HTTP PUT upload parameters used during the exfiltration phase. Microsoft confirmed that the investigation revealed active data exfiltration rather than simple beaconing.

The Attack Chain

The infection typically begins with a social engineering tactic known as "ClickFix," which tricks users into initiating an interactive zsh session. Once the session is active, the malware uses the curl utility to retrieve a payload from the attacker's infrastructure. This payload is subsequently decoded using Base64 and gunzip to execute the stealer on the victim's machine.

Once active, MacSync Stealer collects sensitive information and stages the data in a local archive located at /tmp/osalogging.zip. To avoid detection during the final stage of the attack, the malware splits this archive into smaller chunks before exfiltrating them to the identified command-and-control domains.

A Growing macOS Threat

MacSync Stealer is part of a broader industry trend where information stealers are expanding from Windows to macOS. These threats often leverage cross-platform languages like Python and abuse trusted platforms to blend in with legitimate system activity. MacSync is frequently deployed alongside other known threats, such as Atomic Stealer (AMOS) and DigitStealer, often disguised as malicious Homebrew advertisements or fake AI tool installers.

Why Behavioral Detection Matters

The use of rapidly rotating infrastructure renders traditional domain-based blocking largely ineffective, as attackers can swap domains faster than security vendors can blacklist them. This research underscores the critical necessity of behavioral-based detection to identify threats that abuse native macOS utilities, such as zsh and osascript, to bypass standard security controls.

What's Next

Security teams are encouraged to monitor for the specific request paths and process patterns identified by Microsoft. As macOS-focused malware continues to evolve and integrate with other stealer families, the industry will likely see an increased reliance on "hunting pivots" to track infrastructure that is designed to be ephemeral.