MacSync Stealer is expanding its macOS-focused theft operation through a rotating network of more than 30 domains, using stable execution and network patterns to steal credentials, browser data, cloud access keys, SSH material, and sensitive user files.
Earlier research by RST Cloud identified MacSync infrastructure and observed command-and-control replacement after public disclosure.
Microsoft’s subsequent telemetry-led investigation connected the wider campaign by correlating endpoint and network evidence across payload delivery, beaconing, collection, staging, and active exfiltration.
Initial execution commonly begins with a ClickFix-style social-engineering lure. Victims are persuaded to paste a command into Terminal, launching an interactive zsh shell that uses curl to fetch attacker-controlled content from paths resembling /curl/[token].
The downloaded payload is then decoded or unpacked using native utilities, including Base64 and gunzip, before script-driven execution begins.
The malware also abuses osascript to bridge AppleScript and shell commands, enabling execution of utilities such as sh, cp, rm, mkdir, curl, and killall.
This combination is significant for defenders because AppleScript spawning shell activity followed by network access, temporary-file staging, or cleanup is a more reliable behavioral signal than a single malicious domain.
Once active, MacSync Stealer profiles the device and searches for high-value data.
Microsoft Defender Experts found that while the infrastructure changes rapidly, the malware’s recurring curl commands, URI paths, headers, staging behavior, and chunked uploads offer defenders durable detection opportunities.
MacSync Stealer Uses 30+ Rotating Domains
Microsoft observed collection targeting macOS Keychain material, browser Safe Storage keys, cookies, credentials, login databases, session data, IndexedDB and LevelDB stores, extension data, Safari artifacts, Apple Notes, browsing history, SSH keys, AWS credentials, Kubernetes configuration files, and files in common user directories.
The stealer also checks for cryptocurrency wallet-related artifacts associated with Ledger and Trezor applications.
Rather than merely communicating with C2 servers, the malware stages stolen material under paths matching /tmp/sync*, compresses it into /tmp/osalogging.zip, then splits the archive into chunks for transfer.
Exfiltration uses curl with HTTP PUT requests and the --data-binary option. Requests include recurring fields such as upload_id, chunk_index, and total_chunks, alongside macOS User-Agent strings and API-key headers.
These traits let defenders identify MacSync activity even when operators abandon known domains.
Microsoft linked infrastructure through recurring paths including /curl/, /dynamic?txd=, and /gate?buildtxd=; curl arguments such as -k, -s, --max-time, and --data-binary; and the distinctive chunked-upload parameters.
RST Cloud similarly identified eleven candidate domains through URI behavior and reported a static API-key value shared across four confirmed C2 domains, despite rotating build tokens.
The campaign illustrates why static IOC blocking alone is insufficient against fast-moving macOS malware operations.
Security teams should correlate interactive Terminal or zsh sessions with curl-based downloads, Base64 or gunzip unpacking, osascript-initiated shell activity, sensitive credential-store access, archive creation in temporary directories, and subsequent outbound HTTP PUT traffic.
Organizations should also monitor for deletion of temporary archives, staging directories, and lock files immediately after upload activity, as MacSync attempts to remove evidence after theft.
Detection logic should prioritize the full sequence: suspicious user-initiated shell execution, native utility abuse, collection of credential and cloud artifacts, /tmp staging, archive compression, and chunked curl uploads.
Apple has added ClickFix-focused safeguards in macOS 26.4 and later, including Terminal paste warnings intended to block potentially malicious instructions.
Apple’s XProtect protections can also prevent detected malicious scripts from running.
Enterprises should pair these platform controls with cloud-delivered endpoint protection, web and network filtering, and tamper protection to reduce the chance that users can execute attacker-provided Terminal commands.
IOCs
| fintelliganceai [.]com | Domain | Related MacSync Stealer infrastructure identified through behavioral hunting. |
| homeinspectionsdelaware [.]com | Domain | Related MacSync Stealer infrastructure identified through behavioral hunting. |
| intopython [.]com | Domain | Related MacSync Stealer infrastructure identified through behavioral hunting. |
| lalandscapelighting [.]com | Domain | Related MacSync Stealer infrastructure identified through behavioral hunting. |
| lumenagnet [.]com | Domain | Related MacSync Stealer infrastructure identified through behavioral hunting. |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide
