Microsoft Expands MacSync Beyond Rotating C2 Domains
Microsoft said MacSync Stealer is tied to 30+ related domains, expanding earlier reporting from a smaller set of command-and-control (C2) endpoints. The new view came from Microsoft Defender Experts correlating recurring request patterns instead of trusting the domains themselves.
The malware keeps the same URI shapes, macOS User-Agent strings, API-key headers, and curl upload behavior even as the domains change. Microsoft also found the infrastructure used for collection, staging, and exfiltration, including compressed archives uploaded in chunks, so blocking a known beacon domain can still leave live theft paths open.
For defenders, the map point is the behavior layer, not the reputation layer: if your hunting or blocking logic stops at C2 domains, MacSync can keep moving data through fresh infrastructure. The reporting still leaves the exact scale of victimization open, but it shows the theft phase persists after the obvious beacons move.