Microsoft's threat intelligence team has connected more than 30 web domains to MacSync Stealer, a macOS-focused information-stealing malware, according to a report published Tuesday by the company's Defender Experts unit. The researchers matched recurring endpoint and network behaviors across shifting infrastructure, following the malware through every stage from payload download to data theft and upload. Microsoft didn't reveal how many victims were affected or name a threat actor behind the campaign, but confirmed that active data exfiltration took place, not just outbound beaconing.
The investigation traced attack sequences that began with an interactive zsh Terminal session, behavior consistent with ClickFix social engineering tactics, according to the analysis. The malware used curl to retrieve attacker-controlled payloads over a recurring /curl/ path, then deployed native utilities including Base64 and gunzip to decode or unpack the content. Once active, the payload harvested host and user details, macOS Keychain material, browser credentials and cookies, session tokens, Apple Notes, SSH keys, AWS credentials, Kubernetes configurations, browser history, and sensitive files from common user directories. Collected information was staged under /tmp/sync*, compressed into /tmp/osalogging.zip, split into multiple chunks, and uploaded via curl through HTTP PUT requests carrying recurring parameters such as upload_id, chunk_index, and total_chunks. After exfiltration, the malware erased temporary archives, staging folders, lock files, and other artifacts.
Microsoft's findings expand on an earlier May 8 analysis by RST Cloud, which documented a static API key across four confirmed command-and-control domains and identified 11 additional candidate domains through recurring /dynamic?txd= and /gate?buildtxd= URI patterns. "The hex build token rotates per deployment, the api-key does not," RST Cloud stated. Four domains Microsoft now lists—lalandscapelighting[.]com, lumenagnet[.]com, nailscanai[.]com, and numericagent[.]com—also appeared in RST Cloud's May candidate cluster, though RST Cloud classified those as URI-pattern bound rather than API-key confirmed because it hadn't retrieved samples from each to validate the static API-key match. The August 18 report references API-key headers as a recurring MacSync trait but doesn't publish the static value RST Cloud documented or confirm whether the same value appears across every domain in the current set.
Microsoft identified related infrastructure by correlating recurring network signatures—including the /curl/, /dynamic?txd=, and /gate?buildtxd= paths, macOS User-Agent strings, API-key headers, and HTTP PUT uploads with identical chunk-management parameters—together with endpoint execution context as domains rotated. The company advised organizations to educate users not to paste or run Terminal commands from untrusted sources, monitor unusual Terminal and shell sessions that retrieve payloads or execute commands shortly after user interaction, correlate AppleScript-assisted shell activity with credential-store access and outbound traffic, watch for curl-based HTTP PUT uploads using --data-binary and recurring /gate URI patterns, and investigate connections to suspicious or newly registered domains while hunting for request and process patterns that may persist after infrastructure changes. Apple has separately documented three protections available on macOS 26.4 and later: Terminal paste protection, pasteboard command blocking, and AppleScript scanning. After a 24-hour grace period following initial system setup, the Terminal warning triggers when the user hasn't opened Terminal in more than 30 days, no common developer tooling is detected, and the paste originates from a specified application such as a web browser or messaging app. The disclosure arrives less than two weeks after Microsoft confirmed more than 250 front-end domains in a macOS ClickFix campaign distributing MacSync and Atomic Stealer behind a server-side browser-fingerprinting gate, though the August 18 report doesn't state whether those front-end domains match the more than 30 domains identified through the MacSync behavioral pivots. Defenders who rely solely on static domain blocklists will find themselves perpetually behind attackers who can spin up new infrastructure faster than signatures can propagate, making behavior-based detection the only durable line of defense. Organizations that fail to instrument both endpoint telemetry and network traffic for correlation will miss the thread that ties rotating domains to a single campaign.