Microsoft Shifts MacSync Defense to Behavior Tracking After Mapping 30-Plus Domains
Updated
Updated · TechRadar · Aug 19
Microsoft Shifts MacSync Defense to Behavior Tracking After Mapping 30-Plus Domains
3 articles · Updated · TechRadar · Aug 19
Summary
Microsoft said domain blocking no longer stops MacSync Stealer because the macOS infostealer quickly rotates infrastructure, so defenders should detect attack behavior instead.
More than 30 domains were tied to the campaign by correlating repeated execution patterns, request characteristics, staging activity and exfiltration methods rather than relying on static blocklists.
Key detection signals include shell sessions spawning curl with specific flags, osascript rapidly followed by network activity, and /tmp/sync archives appearing just before outbound HTTP PUT uploads.
MacSync Stealer spreads through ClickFix scams that trick users into pasting Terminal commands, then steals passwords, cookies, Keychain data, crypto wallets, Telegram sessions and SSH or cloud credentials.