MacSync Stealer Expands macOS Credential Theft Campaign with Rotating Infrastructure
A macOS-focused malware campaign, MacSync Stealer, is escalating its operations by leveraging a network of over 30 rotating domains to evade detection while systematically exfiltrating sensitive data. First identified by RST Cloud, the stealer’s infrastructure was later mapped in detail by Microsoft, which correlated endpoint and network activity to uncover its full attack chain.
The malware typically begins with a ClickFix-style social engineering lure, tricking victims into pasting a malicious command into Terminal, which then fetches attacker-controlled content via curl from paths like /curl/[token]. The payload is decoded using native macOS utilities (Base64, gunzip) before executing a script-driven infection.
MacSync Stealer abuses osascript to bridge AppleScript and shell commands, enabling execution of utilities such as sh, cp, rm, mkdir, curl, and killall. This behavior particularly AppleScript spawning shell processes followed by network activity serves as a key detection signal for defenders.
Once active, the malware profiles the device and targets high-value data, including:
- macOS Keychain credentials
- Browser Safe Storage keys, cookies, and login databases
- Safari artifacts, browsing history, and extension data
- SSH keys, AWS credentials, and Kubernetes config files
- Cryptocurrency wallet artifacts (Ledger, Trezor)
- Files in common user directories (e.g., Documents, Downloads)
Stolen data is staged in /tmp/sync* directories, compressed into /tmp/osalogging.zip, and split into chunks for exfiltration via HTTP PUT requests with recurring fields like upload_id, chunk_index, and total_chunks. The malware attempts to cover its tracks by deleting temporary archives and staging directories post-exfiltration.
Despite rapid domain rotation, Microsoft identified durable detection opportunities through:
- Recurring curl commands and URI paths (
/curl/, /dynamic?txd=, /gate?buildtxd=) - Distinctive chunked-upload parameters
- Static API-key headers (shared across multiple C2 domains)
RST Cloud previously reported a static API-key value linked to four confirmed C2 domains, highlighting the limitations of static IOC blocking against fast-moving macOS malware.
Apple has introduced Terminal paste warnings in macOS 26.4+ to mitigate ClickFix-style attacks, while XProtect can block detected malicious scripts. However, enterprises are advised to complement these controls with endpoint protection, network filtering, and tamper protection to prevent execution of attacker-provided Terminal commands.
Notable C2 domains associated with the campaign include:
fintelliganceai[.]comhomeinspectionsdelaware[.]comintopython[.]comlalandscapelighting[.]comlumenagnet[.]comSource: https://gbhackers.com/macsync-stealer-uses-30-rotating-domains/
Apple cybersecurity rating report: https://www.rankiteo.com/company/apple
"id": "APP1787236021",
"linkid": "apple",
"type": "Cyber Attack",
"date": "5/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'type': 'Individuals/Enterprises'}],
'attack_vector': 'Social Engineering (ClickFix-style lure), Malicious '
'Terminal Command Execution',
'data_breach': {'data_exfiltration': 'Yes (HTTP PUT requests with '
'chunked-upload parameters)',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': 'Credentials, Browser Data, SSH '
'Keys, Cryptocurrency Wallet '
'Artifacts, Personal Files'},
'description': 'A macOS-focused malware campaign, MacSync Stealer, is '
'escalating its operations by leveraging a network of over 30 '
'rotating domains to evade detection while systematically '
'exfiltrating sensitive data. The malware abuses osascript to '
'bridge AppleScript and shell commands, targeting high-value '
'data such as macOS Keychain credentials, browser data, SSH '
'keys, cryptocurrency wallet artifacts, and files in common '
'user directories. Stolen data is exfiltrated via HTTP PUT '
'requests with chunked-upload parameters.',
'impact': {'data_compromised': 'macOS Keychain credentials, Browser Safe '
'Storage keys, cookies, login databases, '
'Safari artifacts, SSH keys, AWS credentials, '
'Kubernetes config files, Cryptocurrency '
'wallet artifacts, Files in '
'Documents/Downloads directories',
'identity_theft_risk': 'High',
'payment_information_risk': 'High',
'systems_affected': 'macOS systems'},
'initial_access_broker': {'entry_point': 'ClickFix-style social engineering '
'lure (malicious Terminal command)',
'high_value_targets': 'macOS Keychain, Browser '
'Data, SSH Keys, '
'Cryptocurrency Wallets'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Static IOC blocking is ineffective against fast-moving '
'macOS malware with rotating infrastructure. Detection '
'should focus on behavioral patterns (e.g., AppleScript '
'spawning shell processes, recurring curl commands).',
'motivation': 'Data Theft, Credential Harvesting, Financial Gain',
'post_incident_analysis': {'corrective_actions': 'Enhanced user training, '
'Terminal paste warnings, '
'endpoint protection, '
'network filtering, '
'behavioral detection for '
'macOS threats',
'root_causes': 'Lack of user awareness (social '
'engineering), insufficient '
'Terminal command execution '
'controls, rotating C2 '
'infrastructure evading static IOC '
'blocking'},
'recommendations': 'Implement Terminal paste warnings, endpoint protection, '
'network filtering, tamper protection, and enhanced '
'monitoring for macOS systems. Complement XProtect with '
'additional security controls.',
'references': [{'source': 'RST Cloud'}, {'source': 'Microsoft'}],
'response': {'containment_measures': 'Terminal paste warnings (macOS 26.4+), '
'XProtect blocking malicious scripts',
'enhanced_monitoring': 'Detection of AppleScript spawning shell '
'processes followed by network activity, '
'recurring curl commands, chunked-upload '
'parameters',
'remediation_measures': 'Endpoint protection, network filtering, '
'tamper protection to prevent Terminal '
'command execution',
'third_party_assistance': 'RST Cloud, Microsoft'},
'title': 'MacSync Stealer Expands macOS Credential Theft Campaign with '
'Rotating Infrastructure',
'type': 'Malware (Stealer)'}