Microsoft Defender maps 30 rotating domains to MacSync Stealer via behavioral analysis
Microsoft Defender Experts identified over 30 rotating domains linked to MacSync Stealer, a macOS information stealer, by correlating persistent endpoint and network behaviors rather than relying on static indicators. The malware, delivered via ClickFix social engineering, collects credentials, Keychain data, and cloud secrets, staging them in temporary files before chunked exfiltration. The investigation confirmed active data theft, not just command-and-control beaconing, and highlighted the need for behavioral detection as attackers rapidly rotate infrastructure.