Ethical Hacking News
MacSync Stealer is a sophisticated macOS information stealer that targets valuable data such as Keychain data, saved browser passwords and cookies, SSH keys, AWS credentials, Kubernetes configurations, and files in common user folders. The malware uses a technique known as ClickFix to trick victims into pasting or running commands directly in the macOS Terminal. By focusing on behavioral patterns, Microsoft tracked over 30 MacSync Stealer domains, revealing a campaign targeting passwords, keys, wallets, and other data. The practical takeaway for defenders is to build detection around the recurring shape of the attack itself, rather than focusing on blocking individual domains.
MacSync Stealer is a sophisticated macOS information stealer targeting valuable data such as Keychain, browser passwords, and SSH keys. The malware uses ClickFix to trick victims into pasting or running commands in the macOS Terminal. The infection chain involves social-engineering, shell sessions, and a layered attack using AppleScript and native macOS tools. The malware exfiltrates data through a rotating infrastructure using curl and HTTP PUT requests, focusing on Ledger and Trezor wallet data. Microsoft Defender Experts tracked 30 MacSync Stealer domains by analyzing behavioral patterns. Defending against MacSync Stealer requires building detection around recurring attack patterns, not individual domains.
Microsoft has been tracking a sophisticated macOS information stealer known as MacSync Stealer, which targets valuable data such as Keychain data, saved browser passwords and cookies, SSH keys, AWS credentials, Kubernetes configurations, and files in common user folders. The malware uses a technique known as ClickFix to trick victims into pasting or running commands directly in the macOS Terminal.
The infection chain starts with a trick rather than an exploit, where victims are social-engineered into pasting or running commands directly in the macOS Terminal. Once the shell session fires, curl pulls down attacker-controlled payload content from a path formatted as /curl/[token]. Native macOS tools then decode and unpack the payload, and an AppleScript-driven layer takes over, blending Unix commands with osascript calls that make the whole chain look more like ordinary system scripting than malware.
The malicious code focuses on valuable data, searching for Ledger and Trezor wallet data, and exfiltrating the collected data through a rotating infrastructure using curl and HTTP PUT requests. The upload mechanism itself confirms exfiltration, rather than just suspicious traffic, as it involves staging under temporary paths, compressing the data into an archive, splitting it into chunks, and pushing it out through HTTP PUT requests.
Microsoft Defender Experts tracked over 30 MacSync Stealer domains by focusing on behavioral patterns, revealing a campaign targeting passwords, keys, wallets, and other data. The researchers pointed out that the exfiltration method stays recognizable even when the destination keeps changing, as it uses recurring URI patterns, HTTP headers, and other behaviors.
The attack wraps up with cleanup, deleting temporary archives, staging folders, and lock files after the upload completes. Although this cleanup reduces on-disk evidence, the sequence of archive creation, chunked upload, and deletion can still provide a useful behavioral correlation for defenders.
The practical takeaway for anyone defending Mac fleets is not to focus on blocking individual domains, as that list will be stale within days. Instead, it's building detection around the recurring shape of the attack itself, such as shell sessions spawning curl with specific flag patterns, osascript chaining rapidly into network activity, and archives appearing under /tmp/sync* right before outbound PUT traffic starts.
This approach allows defenders to chase the pattern, not the address, as the address was never going to sit still long enough to matter. By focusing on the behavioral patterns of the attack, defenders can improve their ability to detect and respond to this sophisticated macOS information stealer.
Related Information:
https://www.ethicalhackingnews.com/articles/MacSync-Stealer-Campaign-A-Sophisticated-macOS-Information-Stealer-Targeting-Valuable-Data-ehn.shtml
https://securityaffairs.com/197514/malware/microsoft-tracks-macsync-stealer-by-its-behavior-not-its-domains.html
Published: Wed Aug 19 05:09:58 2026 by llama3.2 3B Q4_K_M
