MacSync Stealer Hunting: New Behavioral Detection

Introduction

Microsoft has published new research on MacSync Stealer, a macOS-focused infostealer that rapidly rotates its infrastructure to evade traditional domain-based detection. For security teams, the key takeaway is clear: static IOC blocking is not enough when attackers frequently swap domains, but consistent behaviors across execution, network traffic, and exfiltration can still provide reliable detection opportunities.

What’s new

Microsoft Defender Experts expanded prior public reporting by using behavioral pivots to connect MacSync Stealer activity across changing infrastructure.

Key findings

• Microsoft linked more than 30 domains to MacSync Stealer activity.
• The malware used recurring URI paths such as /curl/, /dynamic?txd=, and /gate?buildtxd=.
• Requests consistently included macOS User-Agent strings, API-key headers, and specific curl options like -k, -s, --max-time, and --data-binary.
• Researchers confirmed active exfiltration, not just C2 beaconing.
• Stolen data was staged in temporary paths, compressed, split into chunks, and uploaded with HTTP PUT requests using parameters such as upload_id, chunk_index, and total_chunks.

Attack chain overview

The observed attack chain starts with ClickFix-style social engineering, where a user is tricked into pasting or running commands in Terminal. From there:

• curl retrieves the payload from attacker infrastructure.
• Native tools like base64 and gunzip help decode or unpack content.
• osascript is used to drive AppleScript-assisted execution.
• The malware collects Keychain data, browser information, SSH credentials, cloud credentials, and sensitive user files.
• Collected data is archived and uploaded in chunks over rotating infrastructure.
• Temporary artifacts are removed to reduce forensic evidence.

Why this matters for administrators

For SOC analysts and IT administrators managing macOS fleets, this research reinforces the value of behavior-based hunting. Domain indicators may expire quickly, but repeated execution patterns and request shapes often persist longer.

Defenders should prioritize correlation across:

• Shell ancestry and interactive zsh sessions
• Suspicious curl command lines
• osascript launching shell activity
• Archive creation in temporary directories
• Outbound HTTP PUT uploads with chunking parameters

Recommended next steps

• Review detections for interactive Terminal-driven payload execution on managed Macs.
• Hunt for curl activity tied to the URI patterns and upload parameters Microsoft identified.
• Monitor for temporary archive creation followed by outbound uploads.
• Ensure Microsoft Defender for Endpoint or equivalent macOS telemetry is enabled and centrally reviewed.
• Educate users about ClickFix and terminal-based social engineering techniques.

Microsoft’s analysis is a strong reminder that durable detections come from understanding attacker behavior, not just blocking the latest domain list.