Hunting MacSync Stealer infrastructure through behavioral pivots

1. Executive summary

Microsoft Defender Experts published analysis of MacSync Stealer, a macOS-focused information stealer delivered via ClickFix social engineering that tricks users into pasting curl commands into Terminal. The malware collects Keychain material, browser data, SSH keys, cloud credentials, and sensitive files, stages them under /tmp/, and exfiltrates them via chunked HTTP PUT requests using curl. Infrastructure rotates rapidly — over 30 domains identified — but consistent URI paths, API-key headers, and upload parameters provide durable detection pivots. EMEA financial services with macOS endpoints handling privileged credentials or developer workstations are exposed to credential theft and potential downstream access to production environments.

2. Regulatory framing

3. Technical analysis & attack chain

Attribution caveat: No named threat actor is identified in the source material. No MITRE ATT&CK actor profile is available. Attribution is unconfirmed.

Single-source caveat: This advisory is based solely on Microsoft Defender Experts reporting (2026-08-18), which references earlier RST Cloud domain identification. The behavioural pivots, domain set, and attack chain are single-sourced; verify before enforcement.

Attack chain (confirmed steps)

1. Initial access — ClickFix social engineering. User is tricked into pasting or running commands in an interactive zsh Terminal session. The shell session uses curl to retrieve payload content from a /curl/[token] URI path on attacker-controlled infrastructure.
2. Payload decode/unpack. Retrieved payload is decoded or unpacked using native macOS utilities: base64 and gunzip.
3. Execution via AppleScript. Payload uses osascript to run AppleScript-assisted shell commands, blending macOS scripting with Unix tooling. Observed process activity includes sh, cp, rm, curl, mkdir, and killall operations.
4. Discovery and collection. Malware collects host/user information, enumerates running processes and system details, and checks for cryptocurrency wallet applications (Ledger, Trezor local artifacts). Collection targets: - macOS Keychain material - Browser Safe Storage keys, credentials, cookies, login databases, session data - IndexedDB, LevelDB, extension storage - Safari data, Apple Notes - SSH keys - AWS credentials - Kubernetes configurations - Browser profiles, browsing history - Sensitive files from common user directories
5. Staging. Collected data is staged under /tmp/sync* paths and compressed into /tmp/osalogging.zip. The archive is split into multiple chunks.
6. C2 check-in. Malware communicates with attacker infrastructure using: - URI path: /dynamic?txd=[token] - macOS User-Agent string: Mozilla/5.0 (Macintosh...) - API-key header - curl flags: -k -s --max-time 30
7. Exfiltration. Staged archive chunks are uploaded via HTTP PUT using curl with --data-binary @-. Upload requests include: - URI path: /gate?buildtxd=[token] - API-key header - Parameters: upload_id=[id], chunk_index=[n], total_chunks=[n] - curl flags: -k -s -X PUT --data-binary - HTTP response code capture: -w %{http_code}
8. Cleanup. Temporary archives, staging folders (/tmp/sync*), lock files, and other artifacts are removed post-exfiltration.

Infrastructure correlation method: Microsoft linked 30+ domains by requiring multiple behavioural traits to align — process ancestry, command-line patterns, request paths, headers, and upload parameters. RST Cloud identified a static API-key value shared across four confirmed C2 domains while the build token (txd/buildtxd) rotated per deployment. Domains were treated as related only when multiple traits aligned across process, command-line, and network telemetry.

4. Mitigation & containment

P1 — Within 24 hours

• Block known C2 domains at DNS resolver/proxy/firewall. Treat as point-in-time indicators; expect rotation. See §5 for the full domain list.
• Deploy network detection rules for behavioural pivots — see §6 for Sigma rules targeting curl command-line patterns, URI paths, and upload parameters.
• Hunt for existing compromise using the KQL queries below (adapt to your SIEM):
• curl processes with /curl/, /dynamic?txd=, /gate?buildtxd= in remote URLs
• curl processes with --data-binary, -X PUT, upload_id=, chunk_index=, total_chunks= in command lines
• osascript processes spawning sh -c, cp, rm, curl, mkdir, killall, dscl
• Audit macOS endpoints for presence of /tmp/sync* directories or /tmp/osalogging.zip — indicators of active/recent staging.

P2 — Within 72 hours

• Restrict Terminal execution on managed macOS endpoints for non-developer populations via MDM policy (Jamf/Intune).
• Enable macOS 26.4+ protections where available: Terminal paste warnings and XProtect checks that block detected malicious scripts. Apple's ClickFix protections display "Possible malware, Paste blocked" when users attempt to paste potentially malicious commands.
• Review credential exposure: if any endpoint is confirmed compromised, revoke and rotate:
• macOS Keychain credentials
• All browser-stored session tokens and passwords
• SSH keys (~/.ssh/)
• AWS credentials (~/.aws/credentials)
• Kubernetes configs (~/.kube/config)
• Deploy EDR detection for the Microsoft Defender Antivirus signature names: Trojan:MacOS/SuspMalScript, Behavior:MacOS/SuspOsascriptExec, Behavior:MacOS/SuspDownloadFileExec, Behavior:MacOS/SuspPassSteal, Behavior:MacOS/SuspInfoExfil, Trojan:MacOS/SuspMacSyncExfil, Trojan:MacOS/SuspDecodeExec.

P3 — Within 7 days

• Implement egress filtering for curl on macOS endpoints — restrict outbound curl to approved destinations or require proxy routing.
• Enforce browser credential policies — disable credential saving in managed browsers; require enterprise password managers with local vault encryption.
• User awareness training — specifically warn against ClickFix-style social engineering (websites, chat agents, apps instructing users to paste commands into Terminal).

5. Indicators of compromise

domain  aihealthring[.]com
domain  cabinrentalsnc[.]com
domain  chatbasedos[.]com
domain  commercialroofingsd[.]com
domain  dogtrainersgeorgia[.]com
domain  fintelliganceai[.]com
domain  homeinspectionsdelaware[.]com
domain  intopython[.]com
domain  lalandscapelighting[.]com
domain  lumenagnet[.]com
domain  marbellaresales[.]com
domain  miamipcsupport[.]com
domain  moldinspectiondayton[.]com
domain  nailscanai[.]com
domain  newjerseypetsitter[.]com
domain  numericagent[.]com
domain  oaklandwaterdamage[.]com
domain  oklahomawarehousing[.]com
domain  olympiapetemergency[.]com
domain  peaecagent[.]com
domain  plasmaticsystems[.]com
domain  plethorawallet[.]com
domain  premierrentalpurchase[.]com
domain  ricewaterbeauty[.]com
domain  rvieragent[.]com
domain  sandiegotkd[.]com
domain  secueragent[.]com
domain  shiledagent[.]com
domain  syracusefertilitycenter[.]com
domain  vastbets[.]com
domain  wvaeagent[.]com
file  /tmp/sync*
file  /tmp/osalogging.zip
urlpath  /curl/
urlpath  /dynamic?txd=
urlpath  /gate?buildtxd=
urlparam  upload_id=
urlparam  chunk_index=
urlparam  total_chunks=

Behavioural indicators

6. Detection

rule MacSync_Stealer_Behavioral_Pivots {
  meta:
    author = "Adverse Trace"
    date = "2026-08-18"
    reference = "https://www.microsoft.com/en-us/security/blog/2026/08/18/hunting-macsync-stealer-infrastructure-through-behavioral-pivots/"
    description = "Detects MacSync Stealer behavioural pivots: URI paths, upload parameters, staging paths, and curl command-line patterns"
  strings:
    $uri_curl = "/curl/"
    $uri_dynamic = "/dynamic?txd="
    $uri_gate = "/gate?buildtxd="
    $param_upload_id = "upload_id="
    $param_chunk_index = "chunk_index="
    $param_total_chunks = "total_chunks="
    $staging_path = "/tmp/sync"
    $archive_name = "/tmp/osalogging.zip"
    $api_key_header = "api-key:"
    $ua_macos = "Mozilla/5.0 (Macintosh"
    $curl_flags = "--data-binary"
    $http_code = "%{http_code}"
  condition:
    4 of them
}

title: MacSync Stealer C2 Check-in via curl
id: 7a3c1f2e-8b4d-4a6e-9c1f-2d5e8a7b3c6f
status: experimental
description: Detects curl C2 check-in behaviour matching MacSync Stealer patterns including URI paths, API-key headers, and macOS User-Agent strings
author: Adverse Trace
date: 2026/08/18
references:

  - https://www.microsoft.com/en-us/security/blog/2026/08/18/hunting-macsync-stealer-infrastructure-through-behavioral-pivots/
logsource:
  product: macos
  category: process_creation
detection:
  selection_curl:
    Image|endswith: /curl
    CommandLine|contains:

      - "-k"
      - "-s"
      - "--max-time"
      - "api-key:"
      - "/dynamic?txd="
      - "/curl/"
      - "/gate?buildtxd="
      - "--data-binary"
      - "upload_id="
      - "chunk_index="
      - "total_chunks="
  filter_legitimate:
    CommandLine|contains:

      - "api.github.com"
      - "registry.npmjs.org"
  condition: selection_curl and not filter_legitimate
falsepositives:

  - Legitimate curl usage with API-key headers to approved services
level: high

title: MacSync Stealer AppleScript Shell Execution
id: 8b4d2f3e-9c5e-4b7f-0d2e-3e6f9b8c4d7a
status: experimental
description: Detects osascript launching shell commands consistent with MacSync Stealer post-execution chain
author: Adverse Trace
date: 2026/08/18
references:

  - https://www.microsoft.com/en-us/security/blog/2026/08/18/hunting-macsync-stealer-infrastructure-through-behavioral-pivots/
logsource:
  product: macos
  category: process_creation
detection:
  selection_osascript:
    Image|endswith: /osascript
    CommandLine|contains:

      - "sh -c"
      - "cp "
      - "rm "
      - "curl "
      - "mkdir "
      - "killall"
      - "dscl"
  condition: selection_osascript
falsepositives:

  - Legitimate AppleScript automation invoking shell commands
level: medium

title: MacSync Stealer Staging Archive Creation
id: 9c5e3a4f-0d6f-4c8a-1e3f-4f7a0c9d5e8b
status: experimental
description: Detects creation of MacSync Stealer staging archive at /tmp/osalogging.zip
author: Adverse Trace
date: 2026/08/18
references:

  - https://www.microsoft.com/en-us/security/blog/2026/08/18/hunting-macsync-stealer-infrastructure-through-behavioral-pivots/
logsource:
  product: macos
  category: file_event
detection:
  selection_archive:
    TargetFilename|endswith: /tmp/osalogging.zip
  selection_staging:
    TargetFilename|startswith: /tmp/sync
  condition: selection_archive or selection_staging
falsepositives:

  - Unlikely
level: critical

7. Sources

• Microsoft Security Blog, "Hunting MacSync Stealer infrastructure through behavioral pivots," https://www.microsoft.com/en-us/security/blog/2026/08/18/hunting-macsync-stealer-infrastructure-through-behavioral-pivots/, 2026-08-18

8. Adverse Trace position

MacSync Stealer presents a material risk to EMEA financial services running macOS endpoints, particularly developer and operations workstations with access to SSH keys, AWS credentials, and Kubernetes configurations. The ClickFix delivery vector bypasses traditional email-gateway and browser-based controls by exploiting user execution in Terminal. The rapid infrastructure rotation — 30+ domains with per-deployment build tokens — makes static domain blocking insufficient as a standalone control; the durable behavioural pivots (URI paths, API-key headers, chunked upload parameters, staging paths) are the stronger detection surface. No CISA-KEV exploitation state or CVSS score applies as this is a malware campaign, not a CVE. Attribution is unconfirmed — no actor is named in the source. This advisory is single-sourced (Microsoft Defender Experts); we will update with corroborating detail if independent vendors publish overlapping findings. Clients should prioritise P1 hunting queries on macOS endpoint telemetry and validate any hits against the behavioural indicator set before escalating.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.