Rotating domains cannot hide MacSync from Microsoft’s defenders anymore. Defender Experts tied more than 30 hostnames to the macOS infostealer by correlating endpoint and network behavior across the malware’s changing infrastructure, in a report published August 18.
Multiple signals had to line up before a domain counted as connected: process ancestry, command-line patterns, request paths, headers, and upload parameters. Microsoft confirmed active data exfiltration rather than mere beaconing, though it shared no victim count or named actor.
The attack chain starts with a ClickFix-style trick. A victim pastes a command into an interactive zsh Terminal session, curl fetches attacker-controlled content over a recurring /curl/ path, and Base64 plus gunzip decode the payload. AppleScript-assisted execution via osascript follows, then the stealer gathers Keychain material, browser credentials and cookies, session data, Apple Notes, SSH keys, AWS credentials, Kubernetes configurations, and files from common user directories.
Loot is staged under /tmp/sync*, compressed into /tmp/osalogging.zip, split into chunks, and uploaded with curl using recurring PUT parameters like upload_id, chunk_index, and total_chunks. Staging folders and archives are wiped afterward.
RST Cloud’s May analysis first documented a static API key across four confirmed command-and-control domains. Four domains in Microsoft’s current list also appeared in that candidate cluster, and the /dynamic?txd= and /gate?buildtxd= paths recur across both reports.
Microsoft tells users never to paste Terminal commands from untrusted sources. Defenders should watch for odd zsh sessions, AppleScript-linked shell activity, and curl PUT uploads carrying API-key headers. macOS 26.4 and later ships Terminal paste protection, pasteboard command blocking, and AppleScript scanning.
