> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Hunting MacSync Stealer infrastructure through behavioral pivots - URL: https://f4n6.co.uk/security-feed/hunting-macsync-stealer-infrastructure-through-behavioral-pivots/ - Published: 2026-08-18T23:09:29.000Z - Updated: 2026-08-18T23:09:29.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary Microsoft Defender Experts published analysis of MacSync Stealer, a macOS-focused information stealer delivered via ClickFix social engineering that tricks users into pasting curl commands into Terminal. The malware collects Keychain material, browser data, SSH keys, cloud credentials, and sensitive files, stages them under /tmp/, and exfiltrates them via chunked HTTP PUT requests using curl. Infrastructure rotates rapidly — over 30 domains identified — but consistent URI paths, API-key headers, and upload parameters provide durable detection pivots. EMEA financial services with macOS endpoints handling privileged credentials or developer workstations are exposed to credential theft and potential downstream access to production environments. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ----------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | | DORA Art. 17: ICT-related incident management process | MacSync exfiltrates Keychain material, cloud credentials (AWS), and Kubernetes configurations from developer workstations — credentials that could enable follow-on ICT incidents. | Ensure incident runbooks cover macOS endpoint compromise scenarios and credential revocation workflows for stolen cloud/K8s secrets. | | DORA Art. 18: classification of ICT-related incidents and cyber threats | Credential exfiltration from financial services endpoints (SSH keys, cloud creds, browser session data) constitutes a cyber threat with potential major incident classification. | Pre-classify macOS stealer infections as potential major incidents given the sensitivity of exfiltrated developer/admin credentials. | ## 3\. Technical analysis & attack chain **Attribution caveat:** No named threat actor is identified in the source material. No MITRE ATT&CK actor profile is available. Attribution is unconfirmed. **Single-source caveat:** This advisory is based solely on Microsoft Defender Experts reporting (2026-08-18), which references earlier RST Cloud domain identification. The behavioural pivots, domain set, and attack chain are single-sourced; verify before enforcement. ### Attack chain (confirmed steps) 1. **Initial access — ClickFix social engineering.** User is tricked into pasting or running commands in an interactive zsh Terminal session. The shell session uses curl to retrieve payload content from a `/curl/[token]` URI path on attacker-controlled infrastructure. 2. **Payload decode/unpack.** Retrieved payload is decoded or unpacked using native macOS utilities: `base64` and `gunzip`. 3. **Execution via AppleScript.** Payload uses `osascript` to run AppleScript-assisted shell commands, blending macOS scripting with Unix tooling. Observed process activity includes `sh`, `cp`, `rm`, `curl`, `mkdir`, and `killall` operations. 4. **Discovery and collection.** Malware collects host/user information, enumerates running processes and system details, and checks for cryptocurrency wallet applications (Ledger, Trezor local artifacts). Collection targets: - macOS Keychain material - Browser Safe Storage keys, credentials, cookies, login databases, session data - IndexedDB, LevelDB, extension storage - Safari data, Apple Notes - SSH keys - AWS credentials - Kubernetes configurations - Browser profiles, browsing history - Sensitive files from common user directories 5. **Staging.** Collected data is staged under `/tmp/sync*` paths and compressed into `/tmp/osalogging.zip`. The archive is split into multiple chunks. 6. **C2 check-in.** Malware communicates with attacker infrastructure using: - URI path: `/dynamic?txd=[token]` \- macOS User-Agent string: `Mozilla/5.0 (Macintosh...)` \- API-key header - curl flags: `-k -s --max-time 30` 7. **Exfiltration.** Staged archive chunks are uploaded via HTTP PUT using curl with `--data-binary @-`. Upload requests include: - URI path: `/gate?buildtxd=[token]` \- API-key header - Parameters: `upload_id=[id]`, `chunk_index=[n]`, `total_chunks=[n]` \- curl flags: `-k -s -X PUT --data-binary` \- HTTP response code capture: `-w %{http_code}` 8. **Cleanup.** Temporary archives, staging folders (`/tmp/sync*`), lock files, and other artifacts are removed post-exfiltration. **Infrastructure correlation method:** Microsoft linked 30+ domains by requiring multiple behavioural traits to align — process ancestry, command-line patterns, request paths, headers, and upload parameters. RST Cloud identified a static API-key value shared across four confirmed C2 domains while the build token (`txd`/`buildtxd`) rotated per deployment. Domains were treated as related only when multiple traits aligned across process, command-line, and network telemetry. ## 4\. Mitigation & containment ### P1 — Within 24 hours - **Block known C2 domains** at DNS resolver/proxy/firewall. Treat as point-in-time indicators; expect rotation. See §5 for the full domain list. - **Deploy network detection rules** for behavioural pivots — see §6 for Sigma rules targeting curl command-line patterns, URI paths, and upload parameters. - **Hunt for existing compromise** using the KQL queries below (adapt to your SIEM): - curl processes with `/curl/`, `/dynamic?txd=`, `/gate?buildtxd=` in remote URLs - curl processes with `--data-binary`, `-X PUT`, `upload_id=`, `chunk_index=`, `total_chunks=` in command lines - `osascript` processes spawning `sh -c`, `cp`, `rm`, `curl`, `mkdir`, `killall`, `dscl` - **Audit macOS endpoints** for presence of `/tmp/sync*` directories or `/tmp/osalogging.zip` — indicators of active/recent staging. ### P2 — Within 72 hours - **Restrict Terminal execution** on managed macOS endpoints for non-developer populations via MDM policy (Jamf/Intune). - **Enable macOS 26.4+ protections** where available: Terminal paste warnings and XProtect checks that block detected malicious scripts. Apple's ClickFix protections display "Possible malware, Paste blocked" when users attempt to paste potentially malicious commands. - **Review credential exposure:** if any endpoint is confirmed compromised, revoke and rotate: - macOS Keychain credentials - All browser-stored session tokens and passwords - SSH keys (`~/.ssh/`) - AWS credentials (`~/.aws/credentials`) - Kubernetes configs (`~/.kube/config`) - **Deploy EDR detection** for the Microsoft Defender Antivirus signature names: `Trojan:MacOS/SuspMalScript`, `Behavior:MacOS/SuspOsascriptExec`, `Behavior:MacOS/SuspDownloadFileExec`, `Behavior:MacOS/SuspPassSteal`, `Behavior:MacOS/SuspInfoExfil`, `Trojan:MacOS/SuspMacSyncExfil`, `Trojan:MacOS/SuspDecodeExec`. ### P3 — Within 7 days - **Implement egress filtering** for curl on macOS endpoints — restrict outbound curl to approved destinations or require proxy routing. - **Enforce browser credential policies** — disable credential saving in managed browsers; require enterprise password managers with local vault encryption. - **User awareness training** — specifically warn against ClickFix-style social engineering (websites, chat agents, apps instructing users to paste commands into Terminal). ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | ------------- | ------------------------------- | ----------------------- | ----------------------- | | Domain | aihealthring\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | cabinrentalsnc\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | chatbasedos\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | commercialroofingsd\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | dogtrainersgeorgia\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | fintelliganceai\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | homeinspectionsdelaware\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | intopython\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | lalandscapelighting\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | lumenagnet\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | marbellaresales\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | miamipcsupport\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | moldinspectiondayton\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | nailscanai\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | newjerseypetsitter\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | numericagent\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | oaklandwaterdamage\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | oklahomawarehousing\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | olympiapetemergency\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | peaecagent\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | plasmaticsystems\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | plethorawallet\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | premierrentalpurchase\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | ricewaterbeauty\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | rvieragent\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | sandiegotkd\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | secueragent\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | shiledagent\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | syracusefertilitycenter\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | vastbets\[.\]com | Medium — single-sourced | Microsoft Security Blog | | Domain | wvaeagent\[.\]com | Medium — single-sourced | Microsoft Security Blog | | File path | /tmp/sync\* | High | Microsoft Security Blog | | File path | /tmp/osalogging.zip | High | Microsoft Security Blog | | URL path | /curl/ | High | Microsoft Security Blog | | URL path | /dynamic?txd= | High | Microsoft Security Blog | | URL path | /gate?buildtxd= | High | Microsoft Security Blog | | URL parameter | upload\_id= | High | Microsoft Security Blog | | URL parameter | chunk\_index= | High | Microsoft Security Blog | | URL parameter | total\_chunks= | High | Microsoft Security Blog | ```iocs domain aihealthring[.]com domain cabinrentalsnc[.]com domain chatbasedos[.]com domain commercialroofingsd[.]com domain dogtrainersgeorgia[.]com domain fintelliganceai[.]com domain homeinspectionsdelaware[.]com domain intopython[.]com domain lalandscapelighting[.]com domain lumenagnet[.]com domain marbellaresales[.]com domain miamipcsupport[.]com domain moldinspectiondayton[.]com domain nailscanai[.]com domain newjerseypetsitter[.]com domain numericagent[.]com domain oaklandwaterdamage[.]com domain oklahomawarehousing[.]com domain olympiapetemergency[.]com domain peaecagent[.]com domain plasmaticsystems[.]com domain plethorawallet[.]com domain premierrentalpurchase[.]com domain ricewaterbeauty[.]com domain rvieragent[.]com domain sandiegotkd[.]com domain secueragent[.]com domain shiledagent[.]com domain syracusefertilitycenter[.]com domain vastbets[.]com domain wvaeagent[.]com file /tmp/sync* file /tmp/osalogging.zip urlpath /curl/ urlpath /dynamic?txd= urlpath /gate?buildtxd= urlparam upload_id= urlparam chunk_index= urlparam total_chunks= ``` ### Behavioural indicators | Behaviour | Where to observe | Confidence | | -------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------- | ---------- | | Interactive zsh session launching curl to retrieve payload from /curl/ path | Endpoint process telemetry (process ancestry: Terminal → zsh → curl) | High | | Payload decoded using base64 and gunzip in sequence | Endpoint process telemetry (process command line) | High | | osascript spawning shell commands (sh -c, cp, rm, curl, mkdir, killall, dscl) | Endpoint process telemetry (parent-child process tree) | High | | curl with \-k -s --max-time 30, api-key header, macOS User-Agent, hitting /dynamic?txd= | Network telemetry (URL, headers, user-agent) | High | | Archive creation at /tmp/osalogging.zip from /tmp/sync\* staging directory | File system telemetry (file create events under /tmp/) | High | | curl HTTP PUT with \--data-binary, upload\_id, chunk\_index, total\_chunks parameters to /gate?buildtxd= | Network telemetry (HTTP method, URL parameters, request body) | High | | Deletion of /tmp/sync\*, /tmp/osalogging.zip, and lock files after upload | File system telemetry (file deletion events) | High | | Access to \~/.ssh/, \~/.aws/credentials, \~/.kube/config by non-standard process | Endpoint file access telemetry | High | ## 6\. Detection ```yara rule MacSync_Stealer_Behavioral_Pivots { meta: author = "Adverse Trace" date = "2026-08-18" reference = "https://www.microsoft.com/en-us/security/blog/2026/08/18/hunting-macsync-stealer-infrastructure-through-behavioral-pivots/" description = "Detects MacSync Stealer behavioural pivots: URI paths, upload parameters, staging paths, and curl command-line patterns" strings: $uri_curl = "/curl/" $uri_dynamic = "/dynamic?txd=" $uri_gate = "/gate?buildtxd=" $param_upload_id = "upload_id=" $param_chunk_index = "chunk_index=" $param_total_chunks = "total_chunks=" $staging_path = "/tmp/sync" $archive_name = "/tmp/osalogging.zip" $api_key_header = "api-key:" $ua_macos = "Mozilla/5.0 (Macintosh" $curl_flags = "--data-binary" $http_code = "%{http_code}" condition: 4 of them } ``` ```yaml title: MacSync Stealer C2 Check-in via curl id: 7a3c1f2e-8b4d-4a6e-9c1f-2d5e8a7b3c6f status: experimental description: Detects curl C2 check-in behaviour matching MacSync Stealer patterns including URI paths, API-key headers, and macOS User-Agent strings author: Adverse Trace date: 2026/08/18 references: - https://www.microsoft.com/en-us/security/blog/2026/08/18/hunting-macsync-stealer-infrastructure-through-behavioral-pivots/ logsource: product: macos category: process_creation detection: selection_curl: Image|endswith: /curl CommandLine|contains: - "-k" - "-s" - "--max-time" - "api-key:" - "/dynamic?txd=" - "/curl/" - "/gate?buildtxd=" - "--data-binary" - "upload_id=" - "chunk_index=" - "total_chunks=" filter_legitimate: CommandLine|contains: - "api.github.com" - "registry.npmjs.org" condition: selection_curl and not filter_legitimate falsepositives: - Legitimate curl usage with API-key headers to approved services level: high ``` ```yaml title: MacSync Stealer AppleScript Shell Execution id: 8b4d2f3e-9c5e-4b7f-0d2e-3e6f9b8c4d7a status: experimental description: Detects osascript launching shell commands consistent with MacSync Stealer post-execution chain author: Adverse Trace date: 2026/08/18 references: - https://www.microsoft.com/en-us/security/blog/2026/08/18/hunting-macsync-stealer-infrastructure-through-behavioral-pivots/ logsource: product: macos category: process_creation detection: selection_osascript: Image|endswith: /osascript CommandLine|contains: - "sh -c" - "cp " - "rm " - "curl " - "mkdir " - "killall" - "dscl" condition: selection_osascript falsepositives: - Legitimate AppleScript automation invoking shell commands level: medium ``` ```yaml title: MacSync Stealer Staging Archive Creation id: 9c5e3a4f-0d6f-4c8a-1e3f-4f7a0c9d5e8b status: experimental description: Detects creation of MacSync Stealer staging archive at /tmp/osalogging.zip author: Adverse Trace date: 2026/08/18 references: - https://www.microsoft.com/en-us/security/blog/2026/08/18/hunting-macsync-stealer-infrastructure-through-behavioral-pivots/ logsource: product: macos category: file_event detection: selection_archive: TargetFilename|endswith: /tmp/osalogging.zip selection_staging: TargetFilename|startswith: /tmp/sync condition: selection_archive or selection_staging falsepositives: - Unlikely level: critical ``` ## 7\. Sources - Microsoft Security Blog, "Hunting MacSync Stealer infrastructure through behavioral pivots," https://www.microsoft.com/en-us/security/blog/2026/08/18/hunting-macsync-stealer-infrastructure-through-behavioral-pivots/, 2026-08-18 ## 8\. Adverse Trace position MacSync Stealer presents a material risk to EMEA financial services running macOS endpoints, particularly developer and operations workstations with access to SSH keys, AWS credentials, and Kubernetes configurations. The ClickFix delivery vector bypasses traditional email-gateway and browser-based controls by exploiting user execution in Terminal. The rapid infrastructure rotation — 30+ domains with per-deployment build tokens — makes static domain blocking insufficient as a standalone control; the durable behavioural pivots (URI paths, API-key headers, chunked upload parameters, staging paths) are the stronger detection surface. No CISA-KEV exploitation state or CVSS score applies as this is a malware campaign, not a CVE. Attribution is unconfirmed — no actor is named in the source. This advisory is single-sourced (Microsoft Defender Experts); we will update with corroborating detail if independent vendors publish overlapping findings. Clients should prioritise P1 hunting queries on macOS endpoint telemetry and validate any hits against the behavioural indicator set before escalating. --- [Read the original source →](https://www.microsoft.com/en-us/security/blog/2026/08/18/hunting-macsync-stealer-infrastructure-through-behavioral-pivots/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*