Key Takeaways
- Microsoft Defender Experts tied more than 30 web domains to the macOS‑focused MacSync Stealer by correlating endpoint and network behaviors rather than relying solely on static indicators.
- The malware’s infection chain begins with a social‑engineered ClickFix lure that tricks users into pasting malicious commands into a zsh Terminal, after which it downloads, decodes, and executes a payload using native macOS utilities.
- MacSync Stealer harvests a broad range of sensitive data—including Keychain items, browser credentials, SSH keys, AWS and Kubernetes configs, Apple Notes, and files from common user directories—before staging, compressing, chunking, and exfiltrating it via HTTP PUT requests with recurring parameters (upload_id, chunk_index, total_chunks).
- Recurring network traits observable across the infrastructure include the /curl/, /dynamic?txd=, and /gate?buildtxd= paths, macOS‑specific User‑Agent strings, static API‑key headers, and chunk‑managed PUT uploads.
- Microsoft’s findings align with earlier research from RST Cloud, which identified a static API key across four confirmed C2 domains and additional candidate domains via URI patterns; four of Microsoft’s listed domains overlap with RST’s candidate set.
- Defender recommendations focus on user education, monitoring of anomalous Terminal/zsh activity, correlation of AppleScript‑assisted shell behavior with credential‑store access, and scrutiny of curl‑based PUT uploads with the noted parameters.
- Apple’s macOS 26.4+ protections—Terminal paste protection, pasteboard command blocking, and AppleScript scanning—along with XProtect’s process‑tree and network‑artifact checks, provide built‑in mitigations against this technique.
- The MacSync disclosure follows a separate Microsoft report of >250 front‑end domains in a ClickFix campaign distributing MacSync and Atomic Stealer, though the two domain sets are not confirmed to be identical.
Overview of Microsoft’s Findings
Microsoft Defender Experts announced that they have linked more than 30 web domains to MacSync Stealer, an information‑stealing malware that specifically targets macOS endpoints. Rather than attributing the activity to a named threat actor or disclosing victim counts, the company emphasized that the association was based on a convergence of multiple endpoint and network behaviors observed across shifting infrastructure. By tracing the malware from initial payload retrieval through data collection, staging, and exfiltration, defenders were able to treat a domain as connected only when several behavioral indicators aligned, reducing false positives that might arise from isolated signals.
Detection Methodology: Endpoint and Network Correlations
The detection approach required that specific endpoint artifacts—such as process ancestry, command‑line patterns, and the use of osascript for AppleScript‑assisted execution—coincide with consistent network traits. These network traits included recurring request paths (/curl/, /dynamic?txd=, /gate?buildtxd=), macOS‑specific User‑Agent strings, the presence of static API‑key headers, and HTTP PUT uploads that employed chunk‑management parameters (upload_id, chunk_index, total_chunks). When these elements appeared together across different domains, analysts could infer a common operational infrastructure despite frequent changes in hostnames or IP addresses.
Infection Chain: From ClickFix Lure to Payload Execution
Observed infections typically began with a ClickFix‑style social engineering tactic: victims were induced to paste or run a command in an interactive zsh Terminal session. The command invoked curl to retrieve attacker‑controlled content from a recurring /curl/ endpoint. Once downloaded, the payload was decoded using native utilities such as Base64 and gunzip. The resulting script leveraged osascript to execute AppleScript alongside standard macOS and Unix tools, establishing persistence and preparing the system for data harvesting.
Data Harvesting Capabilities of MacSync Stealer
After execution, MacSync Stealer conducted a comprehensive reconnaissance of the host. It gathered system and user information, extracted macOS Keychain material, harvested browser credentials and cookies, captured session data, and accessed Apple Notes. Additionally, the malware collected SSH keys, Amazon Web Services (AWS) configuration files, Kubernetes manifests, browser history, and sensitive files from common user directories such as Documents, Desktop, and Downloads. This broad data set enables attackers to compromise personal accounts, corporate cloud environments, and development workflows.
Exfiltration Process: Staging, Compression, and Chunked Upload
Collected information was first staged under temporary files matching the pattern /tmp/sync*. The data was then compressed into a single archive, /tmp/osalogging.zip, and split into multiple chunks for stealthier transmission. Each chunk was uploaded via curl using HTTP PUT requests that carried the distinctive parameters upload_id, chunk_index, and total_chunks. After successful exfiltration, the malware cleaned up temporary archives, staging folders, lock files, and other artifacts to minimize forensic footprints, thereby prolonging its undetected presence on the victim machine.
Relation to RST Cloud’s Earlier Analysis
Microsoft’s disclosure builds on research published by RST Cloud on May 8, which identified a static API key across four confirmed command‑and‑control (C2) domains and flagged 11 additional candidate domains based on recurring URI patterns (/dynamic?txd= and /gate?buildtxd=). RST Cloud noted that the hex build token rotated per deployment while the API key remained constant, suggesting parallel C2 operation rather than strict sequential rotation. Four of the domains Microsoft now lists—lalandscapelighting[.]com, lumenagnet[.]com, nailscanai[.]com, and numericagent[.]com—appeared in RST Cloud’s candidate cluster, although RST had classified them as URI‑pattern bound because it had not yet retrieved samples to validate the static API‑key match.
Comparison of Indicator Sets
A side‑by‑side comparison conducted by The Hacker News revealed that Microsoft’s August 18 indicator list shares overlap with RST Cloud’s earlier findings but diverges in certain respects. Microsoft did not publish the exact static API‑key value documented by RST Cloud, nor did it explicitly state that the same key appears across every domain in its current set. Instead, Microsoft emphasized the recurring network traits (the specific paths, User‑Agent strings, API‑key headers, and chunk‑managed PUT uploads) as the reliable pivots for tracking the infrastructure, allowing defenders to follow the threat actors even as they rotate domains.
Recurring Network Traits and Defensive Correlation
The core of Microsoft’s detection strategy rests on recognizing the consistent request shapes: curl retrievals from /curl/, API‑key‑header‑laden requests, and HTTP PUT uploads that follow the chunking pattern. When these network signals are coupled with endpoint evidence—such as a zsh session spawning osascript, accessing the Keychain, creating temporary archives under /tmp, and subsequently issuing outbound PUT traffic—analysts can high‑confidence associate the activity with MacSync Stealer. This multi‑dimensional correlation reduces reliance on any single indicator, which may be altered or obscured by the adversary.
Observed Domain Indicators (Summary)
Microsoft provided a point‑in-time list of domains observed in activity consistent with MacSync Stealer. The set includes names such as aihealthring[.]com, cabinrentalsnc[.]com, chatbasedos[.]com, commercialroofingsd[.]com, dogtrainersgeorgia[.]com, fintelliganceai[.]com, homeinspectionsdelaware[.]com, intopython[.]com, and many others spanning sectors like landscaping, IT support, pet sitting, and water damage remediation. While publishing the full list aids threat‑intelligence sharing, the defining characteristic remains the behavioral patterns rather than the specific hostnames, which are likely to change frequently.
Guidance for Organizations
To defend against this threat, Microsoft advises a layered approach:
- Educate users to never paste or execute Terminal commands from unverified sources, including websites, chat messages, apps, files, or phone‑based instructions.
- Monitor for anomalous Terminal, zsh, or shell sessions that retrieve payloads, decode content, or execute commands shortly after user interaction.
- Correlate AppleScript‑assisted shell activity with accesses to credential stores, the creation of archives under temporary paths (e.g., /tmp/sync*), and subsequent outbound traffic.
- Scrutinize curl‑based HTTP PUT uploads that use –data‑binary, contain API‑key headers, and include upload identifiers, chunk indexes, total chunk counts, and recurring /gate URI patterns.
- Investigate connections to suspicious or newly registered domains while continuing to hunt for the request‑and‑process patterns that may persist after infrastructure changes.
Apple’s Built‑in Protections on macOS 26.4+
Apple has introduced three mitigations in macOS 26.4 and later that directly address the infection vector: Terminal paste protection, which warns users when pasting content from a browser or messaging app after a period of inactivity; pasteboard command blocking, which prevents the execution of pasted commands that resemble known malicious patterns; and AppleScript scanning, which inspects AppleScript and JavaScript for Automation scripts—even those run from memory—for malicious behavior. Additionally, XProtect can trace the process tree generated by pasted terminal commands, cross‑reference associated network artifacts with Apple’s Safe Browsing Service, and block actions that match known malware techniques, providing an extra line of defense.
Context Within the Broader ClickFix Campaign
The MacSync disclosure follows a separate Microsoft report released less than two weeks earlier, in which the company confirmed more than 250 front‑end domains in a macOS ClickFix campaign that distributed both MacSync and Atomic Stealer (AMOS) behind a server‑side browser‑fingerprinting gate. Microsoft noted that the August 18 report does not assert that those front‑end domains are identical to the >30 domains identified through the MacSync behavioral pivots, indicating that the threat actors may be leveraging overlapping but distinct infrastructure components to support multiple malware families.
This synthesis captures the essential technical details, defensive recommendations, and contextual information from the original source while adhering to the requested length, structure, and formatting.