On 5 May 2026, a Jamf Protect deployment blocked a download attempt from a newly identified MacSync Stealer C2 domain, jacksonvillemma.com, which was established within 24 hours of the previous C2's public disclosure. Analysis revealed a Stage 2 zsh loader containing a static API key used across four distinct C2 domains from December 2025 to May 2026. Further investigation identified eleven additional candidate C2 domains dating back to February 2026, suggesting the operator runs multiple parallel C2 infrastructures rather than sequentially rotating them. The malware exfiltrates macOS credentials, browser data, and cryptocurrency wallets, and notably transmits the victim's account password in cleartext via URL query strings, making it visible in web proxy logs.

The malware compromises macOS systems by stealing sensitive user credentials, browser data, and cryptocurrency wallets. The cleartext transmission of account passwords via URL query strings increases the risk of credential exposure through network monitoring tools such as web proxies. The use of multiple parallel C2 domains and rapid infrastructure rotation complicates detection and blocking, potentially prolonging infection and data exfiltration.

No official patch or remediation is indicated. Defenders should monitor for network indicators such as the listed C2 domains and hashes to detect and block MacSync Stealer activity. Since the malware transmits credentials in cleartext via URL query strings, inspecting web proxy logs for suspicious queries may aid detection. Endpoint protection solutions like Jamf Protect have demonstrated capability to block download attempts from known C2 domains. Regular updates to detection signatures and threat intelligence feeds including these indicators are recommended.