MacSync Stealer: Microsoft Traces macOS Malware Through 30+ Rotating Domains

Microsoft Defender Experts published research on August 18 connecting more than 30 web domains to MacSync Stealer, a macOS-focused information stealer first documented by RST Cloud in May. The interesting part isn't the malware family itself — it's the method Microsoft used to track it: instead of chasing a list of domains that attackers rotate on a whim, Defender Experts correlated the *behaviors* that stayed constant underneath the changing infrastructure.

How victims get infected

MacSync Stealer spreads through ClickFix social engineering — fake macOS utility pages or malvertising that walk a user through copying a command and pasting it into Terminal, rather than downloading and running a signed application. That single step bypasses Gatekeeper and notarization checks entirely, because the user is executing shell commands directly, not opening an unsigned binary. Microsoft observed the pattern beginning with an interactive zsh session launching curl against a recurring /curl/ path, using flags like -k, -s, --max-time, and --data-binary to fetch a Base64-encoded, gunzip-packed payload.

What it steals, and how it gets the data out

Once running, MacSync Stealer collects host and user information, macOS Keychain material, browser credentials, cookies and session tokens, Apple Notes content, SSH keys, AWS credentials, Kubernetes configuration files, and sensitive documents from common user directories. Stolen data is staged locally under a /tmp/sync* path, compressed into /tmp/osalogging.zip, split into chunks, and exfiltrated via HTTP PUT requests carrying upload_id, chunk_index, and total_chunks parameters.

That target list is worth pausing on. This isn't a browser-password grab aimed at consumer accounts — SSH keys, AWS credentials, and Kubernetes configs are the keys to production infrastructure. A single infected engineer's laptop can hand an attacker a path into cloud environments well beyond the endpoint itself.

Why the behavioral approach matters more than the domain list

The 30+ domains Microsoft published are already stale by the time most defenders read about them — that's the point of rotating infrastructure. What doesn't rotate as easily is the *shape* of the attack: the shell-then-curl execution chain, the staging directory naming convention, and the chunked-upload parameters. Microsoft's guidance for defenders reflects that — detect the post-execution behavior (unusual shell activity, AppleScript execution, Keychain access attempts) and the specific HTTP PUT pattern, rather than relying on a domain blocklist that will be outdated within days.

For security teams still treating macOS as a lower-priority endpoint class, this is a reminder that credential-and-cloud-key theft is now squarely in scope. ClickFix-style lures work because they exploit user trust in a familiar action — copy, paste, run — rather than a technical vulnerability, which means user education and EDR telemetry on macOS fleets both need to be part of the answer, not just perimeter controls.

What to check now

• Alert on interactive Terminal sessions spawning curl with --data-binary or --max-time flags immediately after a user pastes a command from a browser or ad.
• Hunt for staging artifacts matching /tmp/sync* or /tmp/osalogging.zip on macOS endpoints.
• Flag outbound HTTP PUT requests carrying upload_id, chunk_index, or total_chunks parameters to unfamiliar domains.
• Rotate and audit AWS credentials, SSH keys, and Kubernetes configs stored in plaintext on developer and engineer laptops — these were explicitly named as stealer targets.