Microsoft identifies more than 30 domains tied to MacSync Stealer

Microsoft Defender Experts have linked more than 30 web domains to infrastructure associated with MacSync Stealer, a macOS-focused information stealer. The company correlated endpoint and network activity across changing hostnames and said its investigation confirmed active data exfiltration, not simply beaconing.

Microsoft did not disclose a victim count or attribute the operation to a named threat actor. Its August 18 report says a domain was treated as related only when multiple indicators aligned, including process ancestry, command-line patterns, request paths, headers and upload parameters.

ClickFix delivery leads to native macOS execution

Observed execution began in an interactive zsh Terminal session consistent with ClickFix social engineering. Attackers induced users to run commands, after which curl retrieved attacker-controlled content through a recurring /curl/ path. Native tools including Base64 and gunzip decoded or unpacked the payload.

The payload uses osascript for AppleScript-assisted execution alongside macOS and Unix utilities. It gathers host and user details, macOS Keychain material, browser credentials and cookies, session data, Apple Notes, SSH keys, AWS credentials, Kubernetes configurations, browser history and sensitive files in common user directories.

Staging and uploads provide detection pivots

MacSync stages collected files under /tmp/sync*, compresses them into /tmp/osalogging.zip, divides the archive into chunks and uploads them with curl through HTTP PUT requests. Microsoft observed recurring parameters including upload_id, chunk_index and total_chunks. The malware then removes temporary archives, staging folders, lock files and other artifacts.

Recurring network traits include /curl/, /dynamic?txd= and /gate?buildtxd= paths, macOS User-Agent strings, API-key headers and chunked HTTP PUT uploads. Microsoft used these request shapes with the endpoint execution context to follow related infrastructure as domains changed.

The findings extend RST Cloud's May analysis, which documented a static API key across four confirmed command-and-control domains and identified 11 further candidates using recurring URI patterns. Four domains in Microsoft's set also appeared in that candidate cluster: lalandscapelighting[.]com, lumenagnet[.]com, nailscanai[.]com and numericagent[.]com.

Hunting should outlast domain rotation

Microsoft advises organisations to train users not to paste or execute Terminal commands received from untrusted sites, messages, applications, files or phone instructions. Security teams should investigate unusual Terminal, zsh or shell sessions that retrieve content, decode payloads or execute commands shortly after user interaction.

Defenders should correlate AppleScript-assisted shell activity with credential-store access, archive creation in temporary paths and outbound traffic. The broader pattern of malicious macOS delivery through native tools also appears in macOS native-tool malware detection patterns, where endpoint behaviour remains important when attacker infrastructure shifts.

Apple documents Terminal paste protection, pasteboard command blocking and AppleScript scanning on macOS 26.4 and later. For businesses, the practical priority is to detect the combined process and network sequence—rather than relying on domain blocking alone—because those behavioural indicators can remain useful after infrastructure rotates.