Microsoft’s Defender Experts have identified over 30 web domains associated with MacSync Stealer, a macOS-targeted information-stealing malware. This discovery was made by analyzing consistent endpoint and network behaviors across various infrastructures, tracking the malware’s activities from payload retrieval to data exfiltration.
To establish a connection between these domains and MacSync Stealer, Microsoft examined multiple indicators, including process ancestry, command-line patterns, request paths, headers, and upload parameters. This comprehensive approach ensured that only domains exhibiting a full spectrum of malicious behaviors were flagged.
While Microsoft did not specify the number of affected users or attribute the campaign to a particular threat actor, the investigation confirmed active data exfiltration activities. The attack sequence typically begins with an interactive `zsh` Terminal session, often initiated through social engineering tactics like ClickFix. Subsequently, the malware uses `curl` to fetch content from attacker-controlled servers, utilizing paths such as `/curl/`. Native utilities like Base64 and `gunzip` are then employed to decode and unpack the payload.
Once executed, the malware leverages `osascript` for AppleScript-assisted operations, alongside other macOS and Unix utilities. It proceeds to collect a wide range of sensitive information, including host and user details, macOS Keychain data, browser credentials and cookies, session data, Apple Notes, SSH keys, AWS credentials, Kubernetes configurations, browser history, and files from common user directories.
The gathered data is staged in the `/tmp/sync*` directory, compressed into `/tmp/osalogging.zip`, split into multiple chunks, and uploaded via `curl` through HTTP PUT requests. These uploads are characterized by recurring parameters such as `upload_id`, `chunk_index`, and `total_chunks`. After successful exfiltration, the malware cleans up by removing temporary archives, staging folders, lock files, and other artifacts to minimize detection.
This recent disclosure builds upon earlier research by RST Cloud, which, on May 8, identified a static API key across four confirmed command-and-control (C2) domains and 11 additional candidate domains exhibiting similar URI patterns. Notably, four domains—`lalandscapelighting[.]com`, `lumenagnet[.]com`, `nailscanai[.]com`, and `numericagent[.]com`—appear in both Microsoft’s and RST Cloud’s findings, indicating a pattern of infrastructure reuse by the attackers.
Microsoft highlighted recurring network traits associated with MacSync Stealer, including specific paths like `/curl/`, `/dynamic?txd=`, and `/gate?buildtxd=`, macOS User-Agent strings, API-key headers, and HTTP PUT uploads with consistent chunk-management parameters. By correlating these network behaviors with endpoint execution contexts, researchers were able to identify related infrastructures despite the attackers’ efforts to rotate domains.
Microsoft has shared a list of domains observed in activities consistent with MacSync Stealer, including `aihealthring[.]com`, `cabinrentalsnc[.]com`, `chatbasedos[.]com`, `commercialroofingsd[.]com`, `dogtrainersgeorgia[.]com`, `fintelliganceai[.]com`, `homeinspectionsdelaware[.]com`, `intopython[.]com`, and `lalandscapelighting[.]com`.
The identification of these domains underscores the persistent and evolving nature of cyber threats targeting macOS systems. Users and organizations are advised to remain vigilant, employ robust security measures, and stay informed about emerging threats to protect their systems and sensitive information.
