Microsoft links more than 30 domains to MacSync Stealer for macOS with active data exfiltration

Microsoft has linked more than thirty web domains to MacSync Stealer, a malicious program focused on macOS that steals information. Microsoft researchers describe a repeated chain of behavior - from binary recovery to collection, temporary packaging and data exfiltration - and have used that combined telemetry to associate domains even if the infrastructure changes. The company stresses that in order to consider a related domain it required the coincidence of multiple signals in the endpoint and in the network, such as the descent of processes, patterns in the command line, recurring HTTP routes and headers, and climbing parameters in PUT requests. Microsoft has not published the number of victims or attributed the campaign to any identified actors.

Technically, the observed chains are clear at several points. The execution starts frequently from an interactive zsh session in Terminal - a pattern consistent with ClickFix-type deception that induces the user to stick commands - and progresses with curl by recovering content controlled by the attacker from recurrent routes such as / curl /. The payload is decoded with native utilities (Base64, gunzip) and also released through osascript to run AppleScript, in addition to conventional Unix commands. The collection activity includes system and user information, macOS Keychain material, browser credentials and cookies, sessions, Apple Notes, SSH keys, AWS credentials, Kubernetes configurations, navigation history and sensitive user directory files.

The malware groups it collected on time routes such as / tmp / sync * and compresses it into a file called / tmp / osalogging.zip, which in turn is broken and uploaded by HTTP PUT requests with recurring chunk management parameters (upload _ id, chunk _ index, total _ chunks). After exfiltration, the code eliminates temporary files, staging folders, lock files and other artifacts in an attempt to clean up. Microsoft claims to have found active data exfiltration, not just beaconing.

Previous information complements and nuances this portrait. An RST Cloud analysis dated May 8 documented a static key API shared by four confirmed domains and detected eleven candidate domains using URI patterns such as / dynamic? txd = and / gate? build dtxd =. RST Cloud noted that several domains showed overlapping shipping windows, suggesting parallel operation of several C2 rather than a strict rotation by host names. The Hacker News compared the indicators and found that at least four domains cited by Microsoft had previously appeared in the RST Cloud set of candidates. Microsoft mentions as recurring network features the same route patterns, User-Agent agents specific to macOS, headers with API-key and HTTP PUT increases with parameters to manage fragments, but did not publish the static value of the API-key that RST Cloud documented.

What is confirmed: the existence of a family of stealer for macOS that uses execution techniques from Terminal and AppleScript, the stage of collection of credentials and secrets (including Keychain, cookies and keys), the packaging and exfiltration by HTTP PUT in fragments, and the identification of more than 30 related domains by Microsoft in a specific window. What is estimated or plausible: that the identified domains form a C2 button with parallel operation and that a static API key is reused in at least part of the infrastructure (documented by RST Cloud in some cases). What follows is not open or confirmed: the actual number of victims, the identity or motivation of the operator, and if APIkey is identical in all domains cited by Microsoft.

The practical implications for organizations and users are direct. The theft of SSH or AWS credentials and keys can allow persistent access to accounts, additional data extraction and subsequent load execution in cloud infrastructure. The combination of access to notes, session cookies and Keychain facilitates side movements and access to services without breaking passwords. For private users, exposure can result in loss of accounts, identity theft and leakage of personal information; for companies, it has the potential to compromise repositories, development environments and cloud resources with economic and operational impact.

Specific and verifiable measures to be applied by readers and security equipment: first, do not paste or run commands in Terminal from unverified sources including web pages, messages and calls. Activate and configure macOS protections that mitigate command gluing and execution of AppleScript; Apple has documented improvements in protections in recent versions of the operating system and services such as XProtect that analyze execution and scripts artifacts. In working environments, enable policies that prevent the indiscriminate use of Terminal by non-developer users and record interactive shell audit sessions.

In detection and hunting, monitor zsh and other shells sessions by commands that invoke curl to download content, use decoders (base64, gunzip) or call osascript. Correlate AppleScript executions with Keychain access, file creation in / tmp and outgoing traffic to suspicious domains. At the network level, look for HTTP PUT requests with binary bodies (--data-binary in curl), unusual API-key headers and parameters such as upload _ id, chunk _ index or total _ chunks, as well as routes that match / curl /, / dynamic? txd = or / gate? build dtxd =. Check proxy and gateways records for these tracks; these forms of request are a more robust indicator than just consulting a domain that can rotate.

If you suspect commitment, operate on evidence: isolate the team, preserve a forensic image, review shell histories, temporary staging files and process records, and seek fragmented ascending activity from the host. For potentially exposed credentials and keys, root SSH keys and API tokens immediately, replace cloud service credentials (AWS, Kubernetes) and force reauthentication of browser sessions if you detected cookies extraction. Consider the preventive revocation of high-risk keys and the revision of cloud access to detect abnormal movements.

Finally, behavior-based detection is the most practical way to deal with rapidly changing infrastructure: Microsoft made the decision to require multiple signals before marking domains as related, and the same logic is that they should apply corporate defences and EDR solutions to avoid false positive and follow the attacker's movements. Maintain up-to-date systems and signatures, combine endpoint telemetry with network records and external threat intelligence, and prioritize user education on glued command risks and misleading support requests.

Useful public reports to expand this information include manufacturers' security channels and independent analysis; Microsoft publishes details of its research on its security blog ( https: / / www.microsoft.com / security / blog /) and Apple maintains documentation on platform and XProtect protections on its safety and support portal ( https: / / support.apple.com / guide / security / welcome / web). To follow third-party and comparative analysis of indicators, specialized media such as The Hacker News often compile and contextualize these publications ( https: / / thehackernews.com /).