MacSync Stealer, a macOS-focused information-stealing malware, has been linked to more than 30 rotating domains used for payload delivery, command-and-control (C2), and data exfiltration.
Earlier research from RST Cloud identified a smaller set of malicious domains and noted that operators rapidly replaced C2 infrastructure after it was publicly exposed.
Microsoft Defender Experts have now expanded the investigation by tracking recurring endpoint and network behaviors rather than relying only on domain indicators.
The campaign reportedly begins with ClickFix social-engineering lures. Victims are persuaded to paste and run malicious commands in Terminal, launching an interactive zsh shell session.
The commands use curl to retrieve attacker-controlled payloads, then decode or unpack them with native utilities such as Base64 and gunzip.
MacSync Stealer uses AppleScript through osascript to launch shell commands and perform follow-on activity. It uses common macOS tools including sh, cp, rm, mkdir, curl, and killall, helping it blend into normal system activity.
MacSync Stealer’s 30-Domain Theft
Once active, the stealer gathers system and user information before searching for valuable data.
Its targets include macOS Keychain-related material, browser Safe Storage keys, browser passwords, cookies, login databases, session data, browsing history, IndexedDB, LevelDB, extension storage, Safari information, and Apple Notes.
The malware also attempts to steal SSH keys, AWS credentials, Kubernetes configuration files, browser profiles, and sensitive files stored in common folders such as Desktop, Documents, and Downloads.
It searches for file extensions that may contain credentials, cryptocurrency wallets, private keys, VPN configurations, or recovery phrases.
MacSync Stealer checks for cryptocurrency-wallet artifacts linked to Ledger and Trezor applications. This behavior suggests that attackers are seeking both enterprise credentials and personal financial data from infected devices.
Collected files are staged in temporary directories matching /tmp/sync* and compressed into an archive, reportedly named /tmp/osalogging.zip.
The archive is then divided into smaller chunks before transfer, allowing the malware to manage larger data theft operations and potentially reduce the chance of failed uploads.
The operators use rotating domains, but their network requests retain distinct patterns.
Microsoft linked related infrastructure through recurring URI paths such as /curl/, /dynamic?txd=, and /gate?buildtxd=; macOS-specific User-Agent strings; API-key headers; and repeated curl command-line options.
For exfiltration, MacSync Stealer uses HTTP PUT requests with --data-binary.
Uploads include parameters such as upload_id, chunk_index, and total_chunks, confirming that the infrastructure supports active theft rather than simple C2 beaconing, microsoft said.
This gives defenders stronger detection opportunities than static domain blocking alone.
Security teams should hunt for suspicious Terminal or zsh activity followed by curl downloads, osascript-launched shell commands, access to credential stores, archive creation in temporary paths, and HTTP PUT uploads containing chunked-transfer parameters.
Organizations should also educate users not to paste commands from untrusted websites, messages, files, or callers into Terminal.
On supported systems, Apple’s newer macOS protections can warn users and block potentially malicious Terminal pastes, while XProtect may prevent known malicious scripts from executing.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
