Malaysia CISOs urged to hunt MacSync Stealer via behavioral pivots
MacSync Stealer operators use fast-rotating domains but leave durable traces in URI paths, User-Agent strings and chunked upload parameters, Microsoft Defender Experts said.
Source: Microsoft Security Blog · August 18, 2026 at 11:41 PM · AI-assisted report
Single-source
KUALA LUMPUR, 19 AUGUST 2026 —
Listen to this article
DomainFork Audio · read aloud
MacSync Stealer operators use fast-rotating domains but leave durable traces in URI paths, User-Agent strings and chunked upload parameters, Microsoft Defender Experts said.
Market Impact
Microsoft’s threat hunters found the malware relies on ClickFix-style social engineering to trick users into pasting attacker-controlled shell commands that fetch and run further scripts. Once executed, the payload collects macOS Keychain data, browser credentials and sensitive files before staging them in /tmp/sync* paths, compressing to osalogging.zip, splitting into chunks and uploading via HTTP PUT with curl’s --data-binary flag.
The same behavioral chain—shell execution, recurring URI patterns such as /curl/ and /gate?buildtxd=, macOS User-Agent headers, API-key values and upload_id / chunk_index parameters—connects more than 30 domains despite rapid infrastructure turnover.
The investigation traced the activity from payload retrieval through command-and-control check-ins to active exfiltration, using endpoint and network telemetry to establish durable pivots. RST Cloud had earlier flagged a limited set of domains, but Microsoft’s correlation extended coverage by linking execution context with network request shape. Repeated curl command-line options—-k, -s, --max-time and --data-binary—alongside static API-key headers and consistent staging locations gave defenders repeatable ways to hunt the threat even when domains changed.
The attack chain is fast and script-driven, starting with a zsh terminal session, using osascript to blend AppleScript with Unix commands, then quickly moving to sensitive data collection and exfiltration. Microsoft noted hunting value in correlating user-facing shell activity with later network transfers and cleanup steps. After upload, the malware removes temporary files, but the sequence of archive creation, chunked transfer and deletion remains observable.
Apple’s macOS 26.4 update introduced defenses against ClickFix-style attacks by warning users who paste terminal commands and by extending XProtect coverage to block detected malicious scripts. Microsoft recommends macOS users and CISOs prioritise endpoint monitoring for the behavioral patterns Microsoft disclosed, including the recurring URI paths, curl options and upload parameters, and to deploy Microsoft Defender XDR detections where provisioned.
Related: Microsoft