TECHNOMALIST
Microsoft has detailed a new approach to combat the MacSync Stealer, a malware strain targeting Apple devices, by focusing on how the malware behaves rather than which domains it uses. In a report covered by TechRadar Pro, the company says it was able to link more than 30 domains to the campaign through behavioral patterns, even as attackers rapidly cycled through new infrastructure.
MacSync Stealer is designed to extract sensitive information from macOS systems. Its targets include stored passwords, browser data, cookies, Keychain secrets, cryptocurrency wallets, Telegram sessions, and SSH or cloud credentials. The malware spreads through ClickFix scams, where a malicious website presents a fake problem—such as an outdated browser or a document that requires identity verification—and instructs the visitor to open Terminal and paste a command. That command, when executed, installs the malware.
Traditional defenses had relied on blocking the domains associated with the attack, including sites hosting the malware, its command-and-control servers, and locations where stolen data was uploaded. But this strategy proved ineffective because operators would simply register a new domain as soon as the old one was blocked, allowing the operation to continue with little interruption.
To overcome this, Microsoft shifted to analyzing behavioral indicators across its Defender telemetry. Instead of maintaining an ever-growing list of blocked domains, defenders looked at patterns such as repeated command execution, the characteristics of network requests, how files were staged on the system, and the methods used to upload data. By correlating these recurring endpoints and network behaviors, the company says it connected more than 30 domains and determined that the infrastructure was not limited to command-and-control communication; it also supported active data collection, staging, and exfiltration.
The report highlights several specific behavioral signs that can indicate MacSync Stealer activity without relying on domain reputation. These include shell sessions that launch the curl tool with certain flag combinations, rapid chaining of AppleScript (osascript) commands that lead to network activity, and the appearance of archive files in the /tmp/sync directory immediately before outbound PUT requests begin. Microsoft advises defenders to monitor for these patterns rather than focusing solely on blocking domains.
The shift from domain-based blocking to behavior-based detection reflects a broader trend in cybersecurity: as threat actors automate the rotation of infrastructure, static indicators become less valuable. By examining what malware does on a system, security teams can identify malicious activity even when the domain names change. The MacSync Stealer case demonstrates how correlating host and network behaviors can reveal a larger campaign and expose multiple domains from a single set of observations.
TechRadar Pro's coverage notes that Microsoft Defender Experts expanded their view by correlating recurring endpoints and network behaviors across the activity, which led to the discovery of the broader infrastructure. The article does not include independent validation of Microsoft's claims but presents them as the company's account of its detection methodology. Users and administrators interested in the full technical details are directed to Microsoft's report, as the source material does not provide specifics on the exact flag combinations or additional indicators beyond those mentioned.
See an error? Read our corrections policy or email [email protected].
