MacSync Stealer is a macOS-focused information stealer that uses rapidly changing command-and-control (C2) domains to deliver payloads, communicate with infected devices, and steal data.
However, a Microsoft Defender Experts investigation found that the malware keeps several network and execution patterns stable, giving defenders reliable ways to detect activity even after domains change.
Earlier research from RST Cloud identified the malware through a small group of domains and observed fast C2 replacement following public disclosure.
Microsoft later expanded the investigation by correlating endpoint and network telemetry across more than 30 related domains.
The research shows that MacSync Stealer infrastructure supports not only C2 communication but also payload delivery, data staging, and active exfiltration.
The campaign commonly begins with ClickFix-style social engineering. Victims are tricked into pasting malicious commands into the macOS Terminal.
An interactive zsh shell then launches curl to download attacker-controlled content, often through a recurring /curl/ URI path. The downloaded payload may be decoded with Base64 and gunzip before execution.
MacSync Stealer also uses osascript to launch AppleScript-assisted shell commands. Observed commands include sh, curl, cp, rm, mkdir, and killall.
This combination of native macOS tools helps the malware blend into normal system activity while collecting and preparing stolen data.
MacSync Stealer Evades Detection
Although C2 domains rotate, MacSync Stealer consistently uses recognizable request structures. Analysts observed repeated URI paths such as /curl/, /dynamic?txd=, and /gate?buildtxd=.
Requests also used macOS User-Agent strings, API-key headers, and curl options including -k, -s, --max-time, and --data-binary. These repeated features are more useful than static domain indicators.
A defender can hunt for curl processes connecting to unusual domains while using these URI paths, headers, and command-line options.
RST Cloud also identified a static API-key value reused across four confirmed C2 domains, while the build token changed with each deployment. After gaining execution, the malware collects high-value macOS data.
It targets Keychain-related material, browser credentials, cookies, session databases, SSH keys, AWS credentials, Kubernetes configurations, browser profiles, Apple Notes, Safari information, and files stored in Downloads, Documents, and Desktop directories.
It also checks for cryptocurrency wallet artifacts associated with Ledger and Trezor. MacSync Stealer stages collected data in temporary directories, including paths matching /tmp/sync*.
It compresses the stolen information into an archive, reportedly named /tmp/osalogging.zip, before splitting it into smaller chunks for transfer, microsoft said.
Indicators of Compromise
| IOC Type | Indicator / Pattern | Detection Value |
|---|---|---|
| URI path | /curl/[token] | Payload retrieval through curl |
| URI path | /dynamic?txd=[token] | C2 check-in communication |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
 domains to deliver payloads){kind=link}