Microsoft Links 30+ Domains to MacSync Stealer’s Credential-Theft and Data-Exfiltration Infrastructure

More than 30 domains tied to MacSync Stealer, exposing a rotating macOS-focused infrastructure that supports payload delivery, command-and-control, credential theft, staging, and chunked data exfiltration.

The investigation shows why defenders should prioritize repeatable endpoint and network behavior over static domain-based detections.

Observed executions originate from interactive zsh sessions and use curl to fetch payloads from attacker infrastructure, often through recurring /curl/ URI paths.

The retrieved content is decoded with native utilities such as base64 and gunzip, then executed through scripts designed to blend into routine macOS command-line activity.

The malware subsequently retrieves AppleScript content and executes it through osascript, a native macOS utility capable of running scripts supplied through standard input.

That technique lets the operator dynamically deliver collection logic while minimizing the amount of malicious code written to disk.

Microsoft’s correlation efforts focused on traits that survived domain replacement: process ancestry, curl command-line options, URI structures, macOS-themed User-Agent values, API-key headers, and HTTP upload parameters.

Related domains repeatedly used /dynamic?txd= for C2 check-ins and /gate?buildtxd= for uploads, while payload retrieval commonly occurred through /curl/ paths.

This approach linked infrastructure based on operating behavior rather than hostname reuse.

The campaign’s collection phase targets data with immediate credential and financial value.

MacSync Stealer has been associated with harvesting Keychain material, browser credentials and cookies, Safe Storage keys, login databases, session data, SSH keys, AWS credentials, Kubernetes configurations, cryptocurrency wallet artifacts, Apple Notes, and sensitive files stored in common user directories.

RST Cloud previously documented the family’s staging of collected artifacts into /tmp/osalogging.zip, a recurring forensic pivot across MacSync activity.

Exfiltration is a key element of the newly expanded infrastructure picture. Rather than functioning only as a beaconing framework, MacSync stages stolen data in temporary paths, compresses it, splits it into chunks, and transmits it with curl using HTTP PUT requests and the --data-binary option.

Requests include parameters such as upload_id, chunk_index, and total_chunks, providing a reliable detection surface for network defenders.

Microsoft Researchers said that, MacSync Stealer activity begins with ClickFix-style social engineering, in which victims are persuaded to paste attacker-supplied commands into Terminal.

Microsoft Links 30+ Domains

The pattern also demonstrates an evolution from earlier MacSync variants. RST Cloud reported that the current generation uploads a staged archive in 10 MiB chunks and removes the archive after successful transfer, reducing on-disk evidence.

The same research found that a static API-key value persisted across confirmed C2 domains while per-build tokens rotated, illustrating how application-layer identifiers can outlast domain churn.

For defenders, the strongest hunts combine network and endpoint evidence. Security teams should investigate Terminal or zsh sessions that launch curl with -k, -s, --max-time, or --data-binary, particularly when followed by base64, gunzip, osascript, archive creation, or cleanup activity.

Alerts should also cover /tmp/sync* staging locations, /tmp/osalogging.zip, and outbound HTTP PUT traffic carrying chunked-upload parameters.

Credential-protection monitoring is equally important. A sequence involving suspicious shell activity, access to Keychain or browser stores, archive generation, and outbound uploads is far more conclusive than any isolated domain match.

Proxy logs should be reviewed carefully because prior MacSync loader logic has sent a harvested macOS password in a /dynamic query parameter, potentially exposing credentials in full-URI logging systems.

Apple’s native defenses remain a useful control layer: Gatekeeper, notarization, and XProtect can block known malware and remediate detected infections, while XProtect receives automatic signature updates independently of full operating-system upgrades.

However, MacSync’s reliance on user-executed Terminal commands means enterprises must pair platform protections with ClickFix awareness, shell telemetry, behavioral detection, and egress monitoring.

The central lesson is clear: MacSync domains can be replaced quickly, but its execution chain, request structure, temporary staging, and chunked exfiltration remain durable signals for detection and incident response.

Indicators of compromise

oaklandwaterdamage [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
oklahomawarehousing [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
olympiapetemergency [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
peaecagent [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
plasmaticsystems [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now