Microsoft Links 30+ Rotating Domains to Mac Sync Stealer Infrastructure
Summary: Microsoft Defender Experts tied more than 30 web domains to MacSync Stealer, a macOS information stealer, by requiring multiple endpoint and network behaviors to align before linking a domain, including process ancestry, command-line patterns, request paths, headers, and upload parameters. The report, published Tuesday, says execution began from an interactive zsh Terminal session consistent with ClickFix social engineering, with curl pulling content over a recurring /curl/ path and the payload using osascript to collect Keychain material, browser credentials and cookies, SSH keys, AWS credentials, Kubernetes configurations, and Apple Notes before staging data under /tmp/sync*, compressing it into /tmp/osalogging.zip, and uploading it in chunks via HTTP PUT.
What's compelling: Microsoft confirmed active data exfiltration, not just beaconing, and the malware deletes its staging folders and archives after upload, so the theft leaves little behind for responders to find. The infrastructure also rotates: RST Cloud found a static API key across four confirmed command-and-control domains while the hex build token changes per deployment, which is why domain blocklists alone will not hold.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026