Microsoft Defender maps 30 rotating domains to MacSync Stealer via behavioral analysis

Key points

• Microsoft linked 30+ domains to MacSync Stealer using recurring traits like /curl/ paths, API-key headers, and chunked upload parameters.
• The attack chain begins with users pasting commands into Terminal, followed by curl retrieval, Base64 decoding, and osascript execution.
• Collected data includes Keychain material, browser credentials, SSH keys, AWS credentials, and Kubernetes configurations, staged under /tmp/sync*.
• Exfiltration occurs via HTTP PUT requests with upload_id, chunk_index, and total_chunks parameters, followed by cleanup of temporary artifacts.
• Apple’s macOS 26.4 introduces Terminal paste protection and XProtect scanning to mitigate ClickFix-style attacks.

Background

This disclosure follows Microsoft’s August 18 report identifying over 250 front-end domains in a broader macOS ClickFix campaign distributing MacSync and Atomic Stealer. The current analysis expands on RST Cloud’s May 8 findings, which documented a static API key across four confirmed command-and-control domains and identified 11 additional candidates through recurring URI patterns. The behavioral approach addresses the limitations of static domain blocking in rapidly rotating infrastructure.

How outlets are covering it

Microsoft Defender Experts emphasized the durability of behavioral pivots, such as request shapes and process ancestry, over static domain indicators, noting that multiple behaviors must align to confirm a domain’s connection. RST Cloud’s earlier analysis highlighted a static API key shared across confirmed domains, while Microsoft’s report did not disclose the specific value or confirm its presence across all 30 domains. TechRadar framed the finding as a shift toward behavior-based malware detection, underscoring the need for defenders to track request patterns rather than relying on domain blocking. gbhackers.com focused on the ClickFix vector, noting how fake install guides trick users into pasting malicious commands, though its content was largely obscured by technical formatting.

Why it matters

The rapid rotation of MacSync Stealer infrastructure undermines traditional domain-based defenses, making behavioral detection critical for identifying active data exfiltration. The malware’s focus on high-value assets like cloud credentials and Keychain data poses significant risks to organizations and individuals. Apple’s new macOS protections offer a partial mitigation, but user education and monitoring of suspicious Terminal activity remain essential to prevent ClickFix-driven compromises.

What to watch

Defenders should implement the advanced hunting queries provided by Microsoft to detect curl-based payload retrieval and chunked exfiltration. Organizations should educate users against pasting commands from untrusted sources and monitor for AppleScript-assisted shell activity. Apple’s macOS 26.4 protections, including Terminal paste blocking and XProtect, will help mitigate future ClickFix attempts, but continuous behavioral monitoring remains necessary as attackers adapt infrastructure.