Microsoft Linked to MacSync Stealer

Overview

On August 18, 2026, Microsoft Defender Experts revealed that they have linked more than 30 rotating domains to the MacSync Stealer, a macOS‑focused information stealer. By correlating endpoint and network behaviors, Microsoft traced the malware’s infrastructure across payload retrieval, data collection, staging, and exfiltration. The investigation confirmed active data theft, not just beaconing.

Attack Flow

• Initial execution: Begins from an interactive zsh Terminal session, often triggered by ClickFix social engineering.
• Payload retrieval: Uses curl over recurring /curl/ paths, decoded with Base64 and gunzip.
• Execution: Relies on osascript for AppleScript‑assisted execution.
• Data collection: Steals macOS Keychain data, browser credentials, cookies, Apple Notes, SSH keys, AWS credentials, Kubernetes configs, and sensitive files.
• Exfiltration:
  • Data staged under /tmp/sync*.
  • Compressed into /tmp/osalogging.zip.
  • Split into chunks and uploaded via HTTP PUT requests with recurring parameters (upload_id, chunk_index, total_chunks).
  • Cleans up staging folders and artifacts post‑exfiltration.

Infrastructure Indicators

Microsoft identified recurring traits across domains: /curl/, /dynamic?txd=, /gate?buildtxd=, API‑key headers, and chunk‑based uploads. Some overlap with RST Cloud’s May 2026 analysis, which documented a static API key across multiple C2 domains.

Examples of domains linked to MacSync Stealer:

• aihealthring[.]com
• lalandscapelighting[.]com
• lumenagnet[.]com
• nailscanai[.]com
• numericagent[.]com
• secueragent[.]com
• wvaeagent[.]com

Defensive Guidance

Microsoft recommends organizations:

• Educate users: Warn against pasting Terminal commands from untrusted sources.
• Monitor shell activity: Watch for unusual zsh sessions retrieving payloads or executing commands.
• Correlate AppleScript activity: Link AppleScript‑assisted shell activity with credential access and outbound traffic.
• Track curl uploads: Look for recurring PUT requests with chunk parameters and API‑key headers.
• Investigate suspicious domains: Hunt for connections to newly registered or suspicious infrastructure.

Apple’s Built‑In Protections

On macOS 26.4 and later, Apple provides:

• Terminal paste protection: Warns users when pasting commands from browsers or messaging apps.
• Pasteboard command blocking: Prevents execution of malicious pasted commands.
• AppleScript scanning: Inspects scripts executed from memory, blocking known malware techniques.

Expert in the Cloud Insight

MacSync’s infrastructure shows how rotating domains and recurring request patterns sustain long‑term campaigns. By combining endpoint behaviors with network traits, defenders can pivot beyond single indicators to uncover evolving infrastructure. The lesson is clear: defense requires correlation, not just detection.