MacSync Stealer is expanding the risk facing Mac users by turning everyday web browsing and Terminal activity into a route for password theft.

The macOS-focused malware uses short-lived online infrastructure, making simple blocklists less effective and leaving victims exposed to account theft, financial loss, and disclosure of private files.

The campaign begins with ClickFix social engineering. A victim is persuaded to paste a command into Terminal, often after encountering a fake verification, download, or support prompt.

That command retrieves the attacker payload, a pattern also seen in a recent macOS ClickFix attack targeting users through bogus CAPTCHA checks.

Microsoft said in a report shared with Cyber Security News (CSN) that it tracked the activity from command-and-control contact through data collection, temporary storage, and theft.

Its researchers found that recurring network and execution traits tied the operation to more than 30 domains despite rapid infrastructure changes.

The impact reaches far beyond a single saved password. MacSync searches for browser data, Keychain material, cloud and SSH credentials, wallet-related artifacts, Apple Notes, session information, and files stored in common folders.

Those records can give criminals access to personal accounts or provide a foothold into business environments.

MacSync Stealer Hides Behind 30+ Domains

The operator’s domain rotation is central to the campaign. When one address is reported or blocked, another can be used to deliver the payload, receive check-ins, or collect stolen archives.

This approach complicates investigations that depend only on known malicious domains, as illustrated by large macOS ClickFix domain operations reported earlier this month.

Microsoft instead connected the servers through repeatable behaviour. It observed the same request paths, Mac-style browser identifiers, API-key headers, curl options, and chunked uploads across different domains.

MacSync Stealer attack chain (Source - Microsoft) — MacSync Stealer attack chain (Source – Microsoft)

This gave defenders a stronger way to recognize the campaign because the surrounding activity stayed similar even when the web address changed.

Once launched, MacSync uses built-in macOS tools to keep its actions close to normal system activity.

It starts from an interactive zsh session, uses curl to fetch content, and can rely on Base64, gunzip, and AppleScript-assisted commands to unpack and run it.

The tactic echoes a Script Editor ClickFix campaign that sought to sidestep user safeguards.

The malware then gathers high-value information from browsers and the local system. It checks for Ledger and Trezor-related data, takes browser credentials and cookies, and looks for keys, configuration files, and sensitive documents.

It also examines downloads, documents, and desktop locations for file types that may contain passwords, recovery material, or business information.

Data Theft and Defense Steps

After collection, MacSync stores the material in temporary folders and compresses it into an archive before sending it out.

The archive is divided into smaller pieces and uploaded through HTTP PUT requests, then the malware removes temporary files and folders. This sequence confirms theft rather than routine contact with a remote server.

For security teams, the useful signal is the full chain rather than one suspicious domain.

An unusual Terminal or shell session followed by curl downloads, AppleScript activity, access to password stores, archive creation under temporary paths, and outbound uploads should be investigated together.

Similar credential-focused threats, including the new macOS crash report stealer, show why such linked evidence matters.

Users should never paste commands into Terminal from websites, chat messages, apps, files, or telephone instructions they do not fully trust.

Organizations should teach staff to recognize these lures, watch for unexpected shell and osascript activity, and investigate curl traffic that uploads data.

Restricting suspicious outbound connections and protecting password stores can limit damage when prevention fails.

Apple’s newer protections can warn users about potentially harmful Terminal pastes and stop known malicious scripts, but they are not a substitute for caution.

Teams should keep macOS and security tools updated, review alerts involving data staging, and reset affected passwords from a clean device.

Any suspected compromise warrants revoking active sessions and replacing exposed cloud or SSH credentials. The campaign is a reminder that prompts can carry real consequences.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Command-line parameter	-H “api-key:”	API-key header request pattern used in MacSync Stealer command-and-control communication
Command-line parameter	-H “User-Agent: Mozilla/5.0 (Macintosh”	macOS User-Agent request pattern associated with the activity
Command-line parameter	-w %{http_code}	Curl output pattern used to capture HTTP response codes during upload attempts
Command-line parameter	-X PUT –data-binary	HTTP upload pattern associated with data transfer and exfiltration
Command-line parameter	curl -k -s –max-time	Curl-based command-and-control check-in pattern
URL path	/curl/	Payload retrieval path observed in MacSync activity
URL path	/dynamic?txd=	Recurring URI pattern used for command-and-control and infrastructure hunting
URL path	/gate?buildtxd=	Recurring URI pattern associated with chunked HTTP PUT data exfiltration
URL parameter	chunk_index=	Chunk index parameter observed in repeated upload requests
URL parameter	total_chunks=	Total chunk count parameter observed in chunked uploads
URL parameter	upload_id=	Upload-session parameter observed during chunked data transfer
Domain	aihealthring[.]com	Domain observed in MacSync Stealer activity
Domain	cabinrentalsnc[.]com	Related infrastructure identified through behavioural hunting
Domain	chatbasedos[.]com	Related infrastructure identified through behavioural hunting
Domain	commercialroofingsd[.]com	Related infrastructure identified through behavioural hunting
Domain	dogtrainersgeorgia[.]com	Related infrastructure identified through behavioural hunting
Domain	fintelliganceai[.]com	Related infrastructure identified through behavioural hunting
Domain	homeinspectionsdelaware[.]com	Related infrastructure identified through behavioural hunting
Domain	intopython[.]com	Related infrastructure identified through behavioural hunting
Domain	lalandscapelighting[.]com	Related infrastructure identified through behavioural hunting
Domain	lumenagnet[.]com	Related infrastructure identified through behavioural hunting
Domain	marbellaresales[.]com	Related infrastructure identified through behavioural hunting
Domain	miamipcsupport[.]com	Related infrastructure identified through behavioural hunting
Domain	moldinspectiondayton[.]com	Related infrastructure identified through behavioural hunting
Domain	nailscanai[.]com	Related infrastructure identified through behavioural hunting
Domain	newjerseypetsitter[.]com	Related infrastructure identified through behavioural hunting
Domain	numericagent[.]com	Related infrastructure identified through behavioural hunting
Domain	oaklandwaterdamage[.]com	Related infrastructure identified through behavioural hunting
Domain	oklahomawarehousing[.]com	Related infrastructure identified through behavioural hunting
Domain	olympiapetemergency[.]com	Related infrastructure identified through behavioural hunting
Domain	peaecagent[.]com	Related infrastructure identified through behavioural hunting
Domain	plasmaticsystems[.]com	Related infrastructure identified through behavioural hunting
Domain	plethorawallet[.]com	Related infrastructure identified through behavioural hunting
Domain	premierrentalpurchase[.]com	Related infrastructure identified through behavioural hunting
Domain	ricewaterbeauty[.]com	Related infrastructure identified through behavioural hunting
Domain	rvieragent[.]com	Related infrastructure identified through behavioural hunting
Domain	sandiegotkd[.]com	Related infrastructure identified through behavioural hunting
Domain	secueragent[.]com	Related infrastructure identified through behavioural hunting
Domain	shiledagent[.]com	Related infrastructure identified through behavioural hunting
Domain	syracusefertilitycenter[.]com	Related infrastructure identified through behavioural hunting
Domain	vastbets[.]com	Related infrastructure identified through behavioural hunting
Domain	wvaeagent[.]com	Related infrastructure identified through behavioural hunting

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post MacSync Stealer Hides Behind 30+ Domains While Stealing Passwords and Sensitive Mac Data appeared first on Cyber Security News.