Malware · 55 days ago
Microsoft said MacSync Stealer is tied to 30+ related domains, expanding earlier reporting from a smaller set of command-and-control (C2) endpoints. The new view came from Microsoft Defender Experts correlating recurring request patterns instead of trusting the domains themselves.
The malware keeps the same URI shapes, macOS User-Agent strings, API-key headers, and curl upload behavior even as the domains change. Microsoft also found the infrastructure used for collection, staging, and exfiltration, including compressed archives uploaded in chunks, so blocking a known beacon domain can still leave live theft paths open.
For defenders, the map point is the behavior layer, not the reputation layer: if your hunting or blocking logic stops at C2 domains, MacSync can keep moving data through fresh infrastructure. The reporting still leaves the exact scale of victimization open, but it shows the theft phase persists after the obvious beacons move.
3 sources covering this story
Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure
Microsoft links 30+ domains to MacSync Stealer, tracing recurring execution and chunked exfiltration of credentials and sensitive data.
Hunting MacSync Stealer infrastructure through behavioral pivots | Microsoft Security Blog
MacSync Stealer rapidly rotates domains to evade detection, but its behavior remains consistent.
MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer | Huntress
Huntress SOC analysts reverse engineer MacSync Stealer, a macOS infostealer spread through fake Claude Code download pages.
Part of the PlainSec briefing for 2026-08-19