MacSync Stealer: macOS Malware Exploits 30 Rotating Domains for Data Theft
A macOS-targeted information-stealing malware, MacSync Stealer, has been identified using over 30 rotating domains for payload delivery, command-and-control (C2), and data exfiltration. Initially documented by RST Cloud, the campaign’s infrastructure was found to rapidly replace exposed C2 domains. Microsoft Defender Experts later expanded the investigation by tracking behavioral patterns rather than relying solely on domain indicators.
The attack begins with ClickFix social-engineering lures, tricking victims into pasting and executing malicious commands in Terminal, which launches an interactive zsh shell session. The malware retrieves payloads via curl, decoding them with native macOS utilities like Base64 and gunzip. It leverages AppleScript (osascript) and common system tools (sh, cp, rm, mkdir, killall) to blend into legitimate activity.
Once active, MacSync Stealer harvests a wide range of sensitive data, including:
- macOS Keychain and browser Safe Storage keys
- Browser passwords, cookies, login databases, session data, and browsing history
- IndexedDB, LevelDB, extension storage, and Safari data
- Apple Notes, SSH keys, AWS credentials, and Kubernetes config files
- Files from Desktop, Documents, and Downloads folders (targeting credentials, cryptocurrency wallets, private keys, VPN configs, and recovery phrases)
- Cryptocurrency-wallet artifacts from Ledger and Trezor applications
Stolen data is staged in /tmp/sync* directories, compressed into /tmp/osalogging.zip, and split into chunks for exfiltration. The malware uses HTTP PUT requests with parameters like upload_id, chunk_index, and total_chunks, enabling large-scale data theft while reducing failed upload risks.
Microsoft identified distinct network patterns, including:
- Recurring URI paths (/curl/, /dynamic?txd=, /gate?buildtxd=)
- macOS-specific User-Agent strings
- API-key headers
- Repeated curl command-line options
The campaign highlights the malware’s focus on both enterprise credentials and personal financial data, with defenders advised to monitor for suspicious Terminal/zsh activity, osascript-launched commands, credential store access, archive creation in /tmp, and chunked HTTP PUT uploads. While newer macOS protections may warn users or block malicious Terminal pastes, the threat underscores the risks of executing untrusted commands.
Source: https://cyberpress.org/macsync-stealers-30-domain-theft/
Trezor TPRM report: https://www.rankiteo.com/company/trezor
"id": "tre1787128062",
"linkid": "trezor",
"type": "Cyber Attack",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'type': 'Individuals/Enterprises'}],
'attack_vector': 'Social Engineering (ClickFix lures), Malicious Terminal '
'Commands',
'data_breach': {'data_exfiltration': 'Yes (Chunked HTTP PUT requests to C2 '
'domains)',
'file_types_exposed': ['Keychain Files',
'Browser Databases (IndexedDB, '
'LevelDB)',
'SSH/AWS/Kubernetes Configs',
'Cryptocurrency Wallet Files',
'Text/Document Files'],
'personally_identifiable_information': 'Yes (Browser '
'Passwords, Cookies, '
'Session Data, Notes, '
'Personal Files)',
'sensitivity_of_data': 'High (PII, Financial Data, '
'Authentication Credentials)',
'type_of_data_compromised': ['Credentials',
'Browser Data',
'Cryptocurrency Wallet Artifacts',
'Personal Files',
'Enterprise Credentials']},
'description': 'A macOS-targeted information-stealing malware, MacSync '
'Stealer, has been identified using over 30 rotating domains '
'for payload delivery, command-and-control (C2), and data '
'exfiltration. The attack begins with ClickFix '
'social-engineering lures, tricking victims into pasting and '
'executing malicious commands in Terminal, which launches an '
'interactive zsh shell session. The malware retrieves payloads '
'via curl, decoding them with native macOS utilities like '
'Base64 and gunzip. It leverages AppleScript (osascript) and '
'common system tools to blend into legitimate activity. Once '
'active, MacSync Stealer harvests sensitive data including '
'macOS Keychain, browser credentials, cryptocurrency wallets, '
'and other personal/enterprise data, staging and exfiltrating '
'it via chunked HTTP PUT requests.',
'impact': {'data_compromised': 'macOS Keychain, Browser '
'Passwords/Cookies/Session Data, '
'Cryptocurrency Wallets, SSH/AWS/Kubernetes '
'Credentials, Personal Files '
'(Desktop/Documents/Downloads), Apple Notes, '
'VPN Configs, Recovery Phrases',
'identity_theft_risk': 'High',
'operational_impact': 'Data Exfiltration, Credential Theft, '
'Potential Unauthorized Access to '
'Systems/Accounts',
'payment_information_risk': 'High',
'systems_affected': 'macOS Systems'},
'initial_access_broker': {'entry_point': 'ClickFix Social Engineering Lures '
'(Terminal Command Execution)',
'high_value_targets': ['Enterprise Credentials',
'Cryptocurrency Wallets',
'Personal Financial Data']},
'investigation_status': 'Ongoing',
'lessons_learned': 'The campaign highlights the risks of executing untrusted '
'commands in Terminal, the effectiveness of behavioral '
'detection over static indicators, and the need for '
'monitoring macOS-specific attack patterns (e.g., '
'osascript, curl-based payload delivery, chunked '
'exfiltration).',
'motivation': 'Data Theft (Credentials, Financial Data, Cryptocurrency '
'Wallets)',
'post_incident_analysis': {'corrective_actions': 'Enhanced monitoring for '
'macOS-specific attack '
'patterns, user training on '
'Terminal security, and '
'adoption of behavioral '
'detection methods.',
'root_causes': 'Execution of untrusted Terminal '
'commands via social engineering, '
'lack of user awareness, and '
'reliance on static indicators for '
'detection.'},
'recommendations': ['Monitor for suspicious Terminal/zsh activity and '
'osascript-launched commands.',
'Block or alert on unusual credential store access (e.g., '
'Keychain, browser Safe Storage).',
'Detect archive creation in /tmp directories and chunked '
'HTTP PUT uploads.',
'Educate users on the risks of pasting commands into '
'Terminal from untrusted sources.',
'Leverage macOS protections (e.g., Gatekeeper, Terminal '
'paste warnings) to block malicious activity.',
'Implement behavioral detection for macOS-specific attack '
'patterns.'],
'references': [{'source': 'RST Cloud'},
{'source': 'Microsoft Defender Experts'}],
'response': {'enhanced_monitoring': 'Monitoring for suspicious Terminal/zsh '
'activity, osascript-launched commands, '
'credential store access, archive '
'creation in /tmp, and chunked HTTP PUT '
'uploads',
'third_party_assistance': 'Microsoft Defender Experts, RST '
'Cloud'},
'title': 'MacSync Stealer: macOS Malware Exploits 30 Rotating Domains for '
'Data Theft',
'type': 'Malware (Information Stealer)'}