Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure
Microsoft Defender Experts linked over 30 rotating web domains to MacSync Stealer, a macOS-focused information stealer, by correlating endpoint and network behaviors across changing infrastructure The malware operates through a ClickFix social engineering vector, using zsh Terminal sessions, curl-based payload retrieval, and osascript for AppleScript-assisted execution to harvest credentials, SSH keys, AWS credentials, Kubernetes configs, and sensitive files Data exfiltration uses HTTP PUT reque
Analysis
TL;DR
- Microsoft Defender Experts linked over 30 rotating web domains to MacSync Stealer, a macOS-focused information stealer, by correlating endpoint and network behaviors across changing infrastructure
- The malware operates through a ClickFix social engineering vector, using zsh Terminal sessions, curl-based payload retrieval, and osascript for AppleScript-assisted execution to harvest credentials, SSH keys, AWS credentials, Kubernetes configs, and sensitive files
- Data exfiltration uses HTTP PUT requests with chunked uploads (upload_id, chunk_index, total_chunks parameters) to C2 domains, with artifacts cleaned post-transfer
- Microsoft's analysis builds on RST Cloud's prior May 8 research, with four overlapping domains confirmed between both indicator sets, though Microsoft did not publish the static API key value or attribute the campaign to a named threat actor
- Apple has introduced Terminal paste protection, pasteboard command blocking, and AppleScript scanning in macOS 26.4+ as defensive countermeasures against this attack pattern
Why It Matters
This disclosure highlights the growing sophistication of macOS-targeted malware campaigns that leverage social engineering (ClickFix) combined with rotating domain infrastructure to evade detection, posing direct risks to enterprise Mac environments. The use of native macOS utilities (curl, osascript, zsh) for every stage of the kill chain demonstrates how attackers exploit trusted system tools to blend in with legitimate activity, making detection reliant on behavioral correlation rather than signature matching.
Technical Details
- Attack chain: Execution begins with a ClickFix-style social engineering lure directing victims to paste commands into an interactive zsh Terminal session; curl retrieves attacker-controlled payloads over recurring
/curl/paths, with Base64 decoding and gunzip unpacking; osascript enables AppleScript-assisted execution alongside native macOS/Unix utilities - Data collection scope: The stealer harvests host/user information, macOS Keychain material, browser credentials and cookies, session data, Apple Notes, SSH keys, AWS credentials, Kubernetes configurations, browser history, and sensitive files from common user directories
- Exfiltration mechanism: Collected data is staged under
/tmp/sync*, compressed into/tmp/osalogging.zip, split into chunks, and uploaded via HTTP PUT requests using recurring parameters (upload_id,chunk_index,total_chunks); all temporary artifacts are removed post-exfiltration - Infrastructure correlation methodology: Microsoft required multiple aligned signals before linking a domain—process ancestry, command-line patterns, request paths (
/curl/,/dynamic?txd=,/gate?buildtxd=), macOS User-Agent strings, API-key headers, and chunk-management parameters—enabling tracking across 30+ rotating domains - macOS 26.4+ defenses: Apple introduced Terminal paste protection (triggered after 24-hour grace period when Terminal hasn't been opened in 30+ days and paste originates from browsers/messaging apps), pasteboard command blocking, and AppleScript scanning; XProtect can trace process trees from pasted terminal commands and check network artifacts against Safe Browsing
Industry Insight
- Security teams managing macOS fleets should prioritize monitoring for unusual Terminal/zsh sessions that retrieve and decode payloads, correlate AppleScript activity with credential-store access, and hunt for curl-based HTTP PUT uploads with chunk-management parameters—even after infrastructure rotates
- The ClickFix social engineering vector combined with native tool abuse represents a low-noise, high-evasion attack pattern that will likely persist; organizations should implement Apple's macOS 26.4+ protections and educate users against pasting Terminal commands from untrusted sources
- The overlap between Microsoft's and RST Cloud's indicator sets validates cross-researcher correlation approaches, suggesting that collaborative threat intelligence sharing around behavioral patterns (rather than just IOCs) is essential for tracking campaigns that frequently rotate infrastructure
Disclaimer: The above content is generated by AI and is for reference only.