Microsoft Defender Experts have identified the MacSync Stealer, a macOS-focused information stealer that utilizes evolving infrastructure for payload delivery, communication with compromised devices, and data exfiltration. This threat was initially reported by RST Cloud, which noted rapid command-and-control (C2) domain changes following public disclosure. The Microsoft team expanded on this by correlating endpoint and network behaviors, linking over 30 domains and revealing that the infrastructure supports not only C2 communication but also active data collection and exfiltration.
The investigation highlighted that despite the rapid rotation of domains, consistent execution patterns and request characteristics provide defenders with opportunities to track MacSync Stealer activity. The malware’s execution typically begins from an interactive shell session, often facilitated by social engineering tactics that trick users into executing commands in Terminal. This session uses curl to retrieve payloads, followed by script-driven execution and outbound communication.
Attack Chain Overview
The MacSync Stealer operates through a fast, script-driven attack chain designed to quickly execute on macOS systems, collect sensitive data, and exfiltrate it via rotating web infrastructure. Each phase of the attack generates telemetry that can be correlated across various events, allowing defenders to track the attack chain through recurring execution tools and request patterns.
Key phases of the attack include:
- Initial Access: The malware is executed from an interactive zsh terminal session, where it retrieves payload content using
curl. - Data Collection: The malware collects sensitive information, including credentials from the macOS Keychain and browser data.
- Data Staging and Exfiltration: Collected data is staged under temporary paths, compressed, and uploaded in chunks using HTTP PUT requests.
- Cleanup: The malware removes temporary files and artifacts to evade detection.
Microsoft recommends several mitigation strategies to combat this threat, including educating users about the risks of executing commands from untrusted sources and monitoring for suspicious shell activity. Additionally, organizations are advised to implement detection mechanisms for HTTP PUT uploads and to restrict outbound traffic to suspicious domains.
For further details, refer to the full report by Microsoft Defender Experts.
Follow Cyber Warriors Middle East for further ransomware, cybercrime and DarkWatch developments.
