Microsoft thwarts MacSync Stealer via behavioral tracking, not domain blocking

MacSync Stealer is an infostealer designed for the Apple ecosystem. It steals passwords, browser data, cookies, Keychain secrets, cryptocurrency wallets, Telegram sessions, SSH and cloud credentials, and other sensitive information. It was distributed through ClickFix scams, where victims visiting a malicious website were told they had a problem — such as an outdated browser or a protected document — and were prompted to open the Terminal and paste a command that actually deployed the malware.

Initially, defenders tried to keep Mac fleets safe by blocking the domains used to host the infrastructure, including websites, malware executables, and exfiltrated data. But Microsoft said that a new domain appeared as soon as an old one was blocked, and the malware continued operating unabated. This led the company to shift to behavior-based detection.

In a new report, Microsoft explained that it successfully identified more than 30 domains by looking at behavioral patterns such as repeated execution, request characteristics, staging behavior, and upload methods. “Microsoft Defender Experts expanded that view by correlating recurring endpoints and network behaviors across the activity. This behavior-led approach connected more than 30 domains and showed that the infrastructure supported more than C2 communication, extending into active collection, staging, and exfiltration,” Microsoft explained.

To defend against MacSync Stealer, Microsoft advises focusing on specific behavioral indicators rather than domain blocking. Security teams should watch for shell sessions spawning ‘curl’ with particular flag combinations, osascript quickly chaining into network activity, and archives appearing under /tmp/sync just before outbound PUT traffic begins. These signs can reveal the malware’s staging and exfiltration processes.