MacSync Stealer: C2 Infrastructure Rotation
On 5 May 2026, a Jamf Protect deployment blocked a download attempt from jacksonvillemma[.]com, four days after the operator's previous MacSync C2 was publicly disclosed. The new C2's TLS certificate was issued within 24 hours of that disclosure. Analysis revealed a Stage 2 zsh loader containing a static api-key value observed across four distinct C2 domains spanning December 2025 to May 2026. URI-pattern pivoting through any.run identified eleven additional candidate C2 domains dating back to February 2026, suggesting parallel infrastructure operation rather than sequential rotation. The loader exfiltrates macOS credentials, browser data, and cryptocurrency wallets, and transmits the victim's account password in cleartext via URL query strings, making it visible in web proxy logs.
AI Analysis
Technical Summary
On 5 May 2026, a Jamf Protect deployment blocked a download attempt from a newly identified MacSync Stealer C2 domain, jacksonvillemma.com, which was established within 24 hours of the previous C2's public disclosure. Analysis revealed a Stage 2 zsh loader containing a static API key used across four distinct C2 domains from December 2025 to May 2026. Further investigation identified eleven additional candidate C2 domains dating back to February 2026, suggesting the operator runs multiple parallel C2 infrastructures rather than sequentially rotating them. The malware exfiltrates macOS credentials, browser data, and cryptocurrency wallets, and notably transmits the victim's account password in cleartext via URL query strings, making it visible in web proxy logs.
Potential Impact
The malware compromises macOS systems by stealing sensitive user credentials, browser data, and cryptocurrency wallets. The cleartext transmission of account passwords via URL query strings increases the risk of credential exposure through network monitoring tools such as web proxies. The use of multiple parallel C2 domains and rapid infrastructure rotation complicates detection and blocking, potentially prolonging infection and data exfiltration.
Mitigation Recommendations
No official patch or remediation is indicated. Defenders should monitor for network indicators such as the listed C2 domains and hashes to detect and block MacSync Stealer activity. Since the malware transmits credentials in cleartext via URL query strings, inspecting web proxy logs for suspicious queries may aid detection. Endpoint protection solutions like Jamf Protect have demonstrated capability to block download attempts from known C2 domains. Regular updates to detection signatures and threat intelligence feeds including these indicators are recommended.
Indicators of Compromise
- domain: tintingsd.com
- hash: 5190ef1733183a0dc63fb623357f56d6
- domain: houstongaragedoorinstallers.com
- domain: pressureulcerlawyer.com
- domain: mansfieldpediatrics.com
- domain: helxiagent.com
- domain: lumenagnet.com
- domain: blzaeagent.com
- domain: nailscanai.com
- domain: glowmedaesthetics.com
- domain: wechatstablecoin.com
- domain: numericagent.com
- domain: jacksonvillemma.com
- domain: lalandscapelighting.com
- hash: 277acd8e241c1341852ebcd401203ecc
- hash: 7d28507870e94b809f25883dc9dae838549ddfac
- hash: 2728a7d444cd65550f652a8c66eaced0fe6d0389161f86393ab73da8f446a362
- hash: 7980485fb1e0b1b1d6307a92b5750c7055bc53b662005cbaa662ac634984363d
- url: http://jacksonvillemma.com/curl/7980485fb1e0b1b1d6307a92b5750c7055bc53b662005cbaa662ac634984363d
- url: http://jacksonvillemma.com/dynamic?txd=7980485fb1e0b1b1d6307a92b5750c7055bc53b662005cbaa662ac634984363d
- url: http://jacksonvillemma.com/gate?buildtxd=7980485fb1e0b1b1d6307a92b5750c7055bc53b662005cbaa662ac634984363d
- domain: harveylewisinsuranceagency.com
MacSync Stealer: C2 Infrastructure Rotation
Description
On 5 May 2026, a Jamf Protect deployment blocked a download attempt from jacksonvillemma[.]com, four days after the operator's previous MacSync C2 was publicly disclosed. The new C2's TLS certificate was issued within 24 hours of that disclosure. Analysis revealed a Stage 2 zsh loader containing a static api-key value observed across four distinct C2 domains spanning December 2025 to May 2026. URI-pattern pivoting through any.run identified eleven additional candidate C2 domains dating back to February 2026, suggesting parallel infrastructure operation rather than sequential rotation. The loader exfiltrates macOS credentials, browser data, and cryptocurrency wallets, and transmits the victim's account password in cleartext via URL query strings, making it visible in web proxy logs.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
On 5 May 2026, a Jamf Protect deployment blocked a download attempt from a newly identified MacSync Stealer C2 domain, jacksonvillemma.com, which was established within 24 hours of the previous C2's public disclosure. Analysis revealed a Stage 2 zsh loader containing a static API key used across four distinct C2 domains from December 2025 to May 2026. Further investigation identified eleven additional candidate C2 domains dating back to February 2026, suggesting the operator runs multiple parallel C2 infrastructures rather than sequentially rotating them. The malware exfiltrates macOS credentials, browser data, and cryptocurrency wallets, and notably transmits the victim's account password in cleartext via URL query strings, making it visible in web proxy logs.
Potential Impact
The malware compromises macOS systems by stealing sensitive user credentials, browser data, and cryptocurrency wallets. The cleartext transmission of account passwords via URL query strings increases the risk of credential exposure through network monitoring tools such as web proxies. The use of multiple parallel C2 domains and rapid infrastructure rotation complicates detection and blocking, potentially prolonging infection and data exfiltration.
Defensive Guidance
No official patch or remediation is indicated. Defenders should monitor for network indicators such as the listed C2 domains and hashes to detect and block MacSync Stealer activity. Since the malware transmits credentials in cleartext via URL query strings, inspecting web proxy logs for suspicious queries may aid detection. Endpoint protection solutions like Jamf Protect have demonstrated capability to block download attempts from known C2 domains. Regular updates to detection signatures and threat intelligence feeds including these indicators are recommended.
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://www.rstcloud.com/macsync-stealer-c2-infrastructure-rotation"]
- Adversary
- mentalpositive
- Pulse Id
- 6a84bafb3c129cc2f9de2762
Indicators of Compromise
Domain
| Value | Description | Copy |
|---|---|---|
domaintintingsd.com | — | |
domainhoustongaragedoorinstallers.com | — | |
domainpressureulcerlawyer.com | — | |
domainmansfieldpediatrics.com | — | |
domainhelxiagent.com | — | |
domainlumenagnet.com | — | |
domainblzaeagent.com | — | |
domainnailscanai.com | — | |
domainglowmedaesthetics.com | — | |
domainwechatstablecoin.com | — | |
domainnumericagent.com | — | |
domainjacksonvillemma.com | — | |
domainlalandscapelighting.com | — | |
domainharveylewisinsuranceagency.com | — |
Hash
| Value | Description | Copy |
|---|---|---|
hash5190ef1733183a0dc63fb623357f56d6 | — | |
hash277acd8e241c1341852ebcd401203ecc | — | |
hash7d28507870e94b809f25883dc9dae838549ddfac | — | |
hash2728a7d444cd65550f652a8c66eaced0fe6d0389161f86393ab73da8f446a362 | — | |
hash7980485fb1e0b1b1d6307a92b5750c7055bc53b662005cbaa662ac634984363d | — |
Url
| Value | Description | Copy |
|---|---|---|
urlhttp://jacksonvillemma.com/curl/7980485fb1e0b1b1d6307a92b5750c7055bc53b662005cbaa662ac634984363d | — | |
urlhttp://jacksonvillemma.com/dynamic?txd=7980485fb1e0b1b1d6307a92b5750c7055bc53b662005cbaa662ac634984363d | — | |
urlhttp://jacksonvillemma.com/gate?buildtxd=7980485fb1e0b1b1d6307a92b5750c7055bc53b662005cbaa662ac634984363d | — |
Threat ID: 6a85ca32acd9273b493fd6f1
Added to database: 08/19/2026, 15:22:26 UTC
Last enriched: 08/19/2026, 15:42:54 UTC
Last updated: 10/02/2026, 03:44:40 UTC
Views: 105
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.