MacSync Stealer is a macOS-focused information stealer that relies on changing infrastructure to deliver payloads, communicate with compromised devices, and exfiltrate data. It begins with social engineering that leads to execution of attacker-controlled payloads via curl commands. The malware communicates with attacker infrastructure using consistent URI paths, macOS User-Agent strings, API-key headers, and curl command-line options, which serve as durable behavioral pivots despite rotating domains. It collects sensitive data such as Keychain material, browser data, credentials, and files, stages and compresses this data, splits it into chunks, and uploads it using HTTP PUT requests with identifiable parameters. Microsoft Defender Experts correlated multiple endpoint and network behaviors to link over 30 domains supporting the malware's infrastructure. This behavior-led approach enables defenders to track and investigate MacSync Stealer activity beyond static domain blocking.

The malware compromises macOS devices by stealing sensitive information including Keychain data, browser credentials, SSH keys, and files from user directories. It actively exfiltrates collected data to attacker-controlled infrastructure, potentially leading to credential theft, unauthorized access, and data breaches. The use of rapidly rotating domains complicates detection and blocking but consistent behavioral patterns provide defenders with reliable detection opportunities. There is no indication of active exploitation in the wild beyond observed activity, and no direct mention of system integrity compromise or ransomware.

No official patch or fix is indicated as this is malware rather than a software vulnerability. Mitigation focuses on detection and response using behavioral indicators such as recurring URI paths (/curl/, /dynamic?txd=, /gate?buildtxd=), specific curl command-line options (-k, -s, –max-time, –data-binary), macOS User-Agent strings, API-key headers, and HTTP PUT upload parameters (upload_id, chunk_index, total_chunks). Defenders should leverage endpoint and network telemetry to identify these patterns and investigate related activity. Blocking individual domains is less effective due to rapid rotation; instead, focus on behavioral detection and correlation across the attack chain. Users should be educated to avoid running untrusted commands in Terminal, especially those received via social engineering.