MacSync Stealer is a macOS-focused information stealer that employs rotating command-and-control (C2) infrastructure to evade detection and maintain persistence. Initial execution typically involves social engineering where users are tricked into running commands in an interactive shell, which downloads and executes payloads using curl with specific command-line options. The malware communicates with attacker-controlled domains using consistent URI paths, macOS User-Agent strings, API-key headers, and HTTP PUT uploads with identifiable parameters such as upload_id, chunk_index, and total_chunks. It actively collects sensitive data including Keychain material, browser and cloud credentials, SSH keys, and files from common directories. Collected data is staged temporarily, compressed, split into chunks, and exfiltrated over HTTP. Microsoft Defender Experts identified over 30 related domains by correlating recurring behavioral traits across payload retrieval, C2 communication, and data exfiltration phases, demonstrating that behavioral pivots provide durable detection methods despite infrastructure rotation.

The malware compromises macOS systems by stealing sensitive credentials and files, including Keychain data, browser credentials, SSH keys, and cloud credentials. This can lead to unauthorized access to user accounts, systems, and cloud resources. Active data exfiltration confirms that stolen information is transmitted to attacker-controlled infrastructure, increasing the risk of further compromise and data breaches.

No official patch or fix is applicable as this is malware relying on social engineering and infrastructure rotation. Defenders should leverage the identified behavioral pivots such as recurring URI patterns, macOS User-Agent strings, API-key headers, and specific curl command-line options to detect and block MacSync Stealer activity. Monitoring for suspicious interactive shell sessions involving curl commands and HTTP PUT uploads with upload_id and chunk parameters can aid in detection. Users should be educated to avoid running untrusted commands in Terminal. Endpoint detection and response solutions should incorporate these behavioral indicators to identify and mitigate infections.