MacSync Stealer is expanding the risk facing Mac users by turning everyday web browsing and Terminal activity into a route for password theft.
The macOS-focused malware uses short-lived online infrastructure, making simple blocklists less effective and leaving victims exposed to account theft, financial loss, and disclosure of private files.
The campaign begins with ClickFix social engineering. A victim is persuaded to paste a command into Terminal, often after encountering a fake verification, download, or support prompt.
That command retrieves the attacker payload, a pattern also seen in a recent macOS ClickFix attack targeting users through bogus CAPTCHA checks.
Microsoft said in a report shared with Cyber Security News (CSN) that it tracked the activity from command-and-control contact through data collection, temporary storage, and theft.
Its researchers found that recurring network and execution traits tied the operation to more than 30 domains despite rapid infrastructure changes.
The impact reaches far beyond a single saved password. MacSync searches for browser data, Keychain material, cloud and SSH credentials, wallet-related artifacts, Apple Notes, session information, and files stored in common folders.
Those records can give criminals access to personal accounts or provide a foothold into business environments.
MacSync Stealer Hides Behind 30+ Domains
The operator’s domain rotation is central to the campaign. When one address is reported or blocked, another can be used to deliver the payload, receive check-ins, or collect stolen archives.
This approach complicates investigations that depend only on known malicious domains, as illustrated by large macOS ClickFix domain operations reported earlier this month.
Microsoft instead connected the servers through repeatable behaviour. It observed the same request paths, Mac-style browser identifiers, API-key headers, curl options, and chunked uploads across different domains.
.webp)
This gave defenders a stronger way to recognize the campaign because the surrounding activity stayed similar even when the web address changed.
Once launched, MacSync uses built-in macOS tools to keep its actions close to normal system activity.
It starts from an interactive zsh session, uses curl to fetch content, and can rely on Base64, gunzip, and AppleScript-assisted commands to unpack and run it.
The tactic echoes a Script Editor ClickFix campaign that sought to sidestep user safeguards.
The malware then gathers high-value information from browsers and the local system. It checks for Ledger and Trezor-related data, takes browser credentials and cookies, and looks for keys, configuration files, and sensitive documents.
It also examines downloads, documents, and desktop locations for file types that may contain passwords, recovery material, or business information.
Data Theft and Defense Steps
After collection, MacSync stores the material in temporary folders and compresses it into an archive before sending it out.
The archive is divided into smaller pieces and uploaded through HTTP PUT requests, then the malware removes temporary files and folders. This sequence confirms theft rather than routine contact with a remote server.
For security teams, the useful signal is the full chain rather than one suspicious domain.
An unusual Terminal or shell session followed by curl downloads, AppleScript activity, access to password stores, archive creation under temporary paths, and outbound uploads should be investigated together.
Similar credential-focused threats, including the new macOS crash report stealer, show why such linked evidence matters.
Users should never paste commands into Terminal from websites, chat messages, apps, files, or telephone instructions they do not fully trust.
Organizations should teach staff to recognize these lures, watch for unexpected shell and osascript activity, and investigate curl traffic that uploads data.
Restricting suspicious outbound connections and protecting password stores can limit damage when prevention fails.
Apple’s newer protections can warn users about potentially harmful Terminal pastes and stop known malicious scripts, but they are not a substitute for caution.
Teams should keep macOS and security tools updated, review alerts involving data staging, and reset affected passwords from a clean device.
Any suspected compromise warrants revoking active sessions and replacing exposed cloud or SSH credentials. The campaign is a reminder that prompts can carry real consequences.
Indicators of compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| Command-line parameter | -H “api-key:” | API-key header request pattern used in MacSync Stealer command-and-control communication |
| Command-line parameter | -H “User-Agent: Mozilla/5.0 (Macintosh” | macOS User-Agent request pattern associated with the activity |
| Command-line parameter | -w %{http_code} | Curl output pattern used to capture HTTP response codes during upload attempts |
| Command-line parameter | -X PUT –data-binary | HTTP upload pattern associated with data transfer and exfiltration |
| Command-line parameter | curl -k -s –max-time | Curl-based command-and-control check-in pattern |
| URL path | /curl/ | Payload retrieval path observed in MacSync activity |
| URL path | /dynamic?txd= | Recurring URI pattern used for command-and-control and infrastructure hunting |
| URL path | /gate?buildtxd= | Recurring URI pattern associated with chunked HTTP PUT data exfiltration |
| URL parameter | chunk_index= | Chunk index parameter observed in repeated upload requests |
| URL parameter | total_chunks= | Total chunk count parameter observed in chunked uploads |
| URL parameter | upload_id= | Upload-session parameter observed during chunked data transfer |
| Domain | aihealthring[.]com | Domain observed in MacSync Stealer activity |
| Domain | cabinrentalsnc[.]com | Related infrastructure identified through behavioural hunting |
| Domain | chatbasedos[.]com | Related infrastructure identified through behavioural hunting |
| Domain | commercialroofingsd[.]com | Related infrastructure identified through behavioural hunting |
| Domain | dogtrainersgeorgia[.]com | Related infrastructure identified through behavioural hunting |
| Domain | fintelliganceai[.]com | Related infrastructure identified through behavioural hunting |
| Domain | homeinspectionsdelaware[.]com | Related infrastructure identified through behavioural hunting |
| Domain | intopython[.]com | Related infrastructure identified through behavioural hunting |
| Domain | lalandscapelighting[.]com | Related infrastructure identified through behavioural hunting |
| Domain | lumenagnet[.]com | Related infrastructure identified through behavioural hunting |
| Domain | marbellaresales[.]com | Related infrastructure identified through behavioural hunting |
| Domain | miamipcsupport[.]com | Related infrastructure identified through behavioural hunting |
| Domain | moldinspectiondayton[.]com | Related infrastructure identified through behavioural hunting |
| Domain | nailscanai[.]com | Related infrastructure identified through behavioural hunting |
| Domain | newjerseypetsitter[.]com | Related infrastructure identified through behavioural hunting |
| Domain | numericagent[.]com | Related infrastructure identified through behavioural hunting |
| Domain | oaklandwaterdamage[.]com | Related infrastructure identified through behavioural hunting |
| Domain | oklahomawarehousing[.]com | Related infrastructure identified through behavioural hunting |
| Domain | olympiapetemergency[.]com | Related infrastructure identified through behavioural hunting |
| Domain | peaecagent[.]com | Related infrastructure identified through behavioural hunting |
| Domain | plasmaticsystems[.]com | Related infrastructure identified through behavioural hunting |
| Domain | plethorawallet[.]com | Related infrastructure identified through behavioural hunting |
| Domain | premierrentalpurchase[.]com | Related infrastructure identified through behavioural hunting |
| Domain | ricewaterbeauty[.]com | Related infrastructure identified through behavioural hunting |
| Domain | rvieragent[.]com | Related infrastructure identified through behavioural hunting |
| Domain | sandiegotkd[.]com | Related infrastructure identified through behavioural hunting |
| Domain | secueragent[.]com | Related infrastructure identified through behavioural hunting |
| Domain | shiledagent[.]com | Related infrastructure identified through behavioural hunting |
| Domain | syracusefertilitycenter[.]com | Related infrastructure identified through behavioural hunting |
| Domain | vastbets[.]com | Related infrastructure identified through behavioural hunting |
| Domain | wvaeagent[.]com | Related infrastructure identified through behavioural hunting |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
