Microsoft Defender Experts published new research on MacSync Stealer infrastructure hunting, showing how defenders can track a fast-moving macOS infostealer even when its domains rotate quickly.

The important lesson is not simply that another stealer is targeting Macs. It is that static indicators are losing value faster than many organizations can operationalize them. Microsoft’s team expanded a limited view of MacSync activity into more than 30 related domains by focusing on repeated behaviors across endpoint execution, command-line use, URI paths, headers, staging, and upload patterns.

What Microsoft found

MacSync Stealer is a macOS-focused information stealer that uses changing infrastructure for payload delivery, command-and-control, collection, staging, and exfiltration. Earlier RST Cloud reporting identified a smaller set of domains and noted rapid C2 replacement after public disclosure. Microsoft Defender Experts then used behavioral pivots to connect additional infrastructure and map the broader attack chain.

The observed activity began from an interactive shell session consistent with ClickFix-style social engineering, where a victim is tricked into running commands in Terminal. From there, curl retrieved attacker-controlled payload content. The malware then used a repeatable mix of shell tooling and AppleScript-assisted execution before collecting sensitive data and staging it for upload.

Microsoft highlighted several recurring signals that stayed useful even as domains changed:

  • Payload retrieval patterns: curl activity against recurring /curl/ paths.
  • C2 check-in traits: repeated URI shapes such as /dynamic?txd=, macOS-like User-Agent strings, API-key headers, and similar curl options.
  • Collection behavior: access to macOS Keychain material, browser data, cookies, local credentials, SSH keys, AWS credentials, Kubernetes configs, Apple Notes, and user files.
  • Staging artifacts: temporary paths such as /tmp/sync* and compressed archives such as /tmp/osalogging.zip.
  • Exfiltration patterns: HTTP PUT uploads using curl with --data-binary and parameters such as upload_id, chunk_index, and total_chunks.

Why this matters for SMBs and government contractors

Mac adoption is no longer unusual in small businesses, engineering teams, executives’ offices, creative shops, security teams, and government contractor environments. Macs often hold the exact material attackers want: browser sessions, password manager access, cloud credentials, SSH keys, source-code access, customer portals, collaboration tokens, and project files.

That makes ClickFix-driven macOS stealers especially dangerous. A user may believe they are fixing a browser, CAPTCHA, video meeting, document, or application problem while actually launching the first stage of a credential-theft chain. If the organization’s Mac visibility is limited to basic antivirus status or MDM enrollment, the compromise may be missed until stolen credentials show up elsewhere.

The practical takeaway is that defenders need to detect sequences, not just domains. Blocking a malicious hostname is useful, but MacSync shows why that is not enough. A domain can rotate; the attacker’s need to retrieve payloads, run commands, touch credential stores, create archives, and upload chunks is much harder to hide.

Defensive takeaways

1. Monitor Terminal and shell paste workflows

ClickFix-style attacks depend on convincing users to run commands. Alert when browsers, messaging apps, PDFs, or recently visited web pages are followed by unusual Terminal, zsh, bash, curl, base64, gunzip, or osascript activity. Newer macOS protections can help, but security teams should still treat suspicious paste-and-run behavior as an identity-risk event.

2. Hunt on command-line patterns, not just network destinations

Look for curl using flags such as -k, -s, timeout options, custom headers, and binary uploads from user contexts. The combination of process ancestry, command-line arguments, URI path, and timing is more durable than any single IOC.

3. Correlate sensitive-file access with archive creation

Mac infostealer behavior should stand out when credential stores, browser databases, cloud configuration files, SSH keys, and user directories are touched shortly before archive creation under temporary paths. Build detections that connect these steps instead of treating each file event in isolation.

4. Watch for chunked HTTP PUT exfiltration

Outbound HTTP PUT uploads from user endpoints deserve scrutiny when paired with curl, temporary archives, --data-binary, or upload parameters like chunk_index and total_chunks. This is especially important where Macs have direct internet access and limited proxy inspection.

5. Bring Macs into the same IR playbook as Windows endpoints

Mac endpoints should have EDR telemetry, MDM baselines, browser credential protections, shell logging where appropriate, and clear containment steps. If a developer or executive Mac is compromised, assume cloud sessions, SSH keys, SaaS tokens, and code repositories may be in scope.

Bulwark Black assessment

MacSync is a clean example of why modern detection needs to move from IOC matching toward behavior-led hunting. Domains, IPs, and build tokens still matter, but they are perishable. The attacker’s workflow is more durable: social engineering, shell execution, payload retrieval, AppleScript-assisted commands, credential collection, temporary staging, chunked upload, and cleanup.

For SMBs and government contractors, the near-term win is visibility. Know which Macs can access sensitive systems, which users routinely need Terminal, what legitimate curl activity looks like, and whether your tools can connect endpoint behavior to outbound network activity. That context turns MacSync-style tradecraft from a mystery domain alert into a readable attack chain.

Bottom line: if your detection logic ends at “block known bad domains,” rotating infrastructure will beat you. Hunt the behavior that has to happen every time.

Original source: Microsoft Security Blog — Hunting MacSync Stealer infrastructure through behavioral pivots.