MacSync Stealer: Microsoft Identifies 31 Domains Used to Target macOS

A Network Uncovered by Tracking the Malware’s Behavior

Microsoft Defender Experts has linked 31 domains to the MacSync Stealer infrastructure, an infostealer designed to steal information from macOS computers. Published on August 18, 2026, the analysis is based on more than hostname reputation: Microsoft tracked the full attack chain, from payload retrieval through data exfiltration.

The correlation considered several technical elements:

• parent processes and process genealogy;
• command-line patterns;
• URI paths;
• HTTP headers;
• parameters used for data transfer;
• execution context within the operating system.

This approach made it possible to distinguish servers actively involved in the operation from merely suspicious domains. Microsoft observed actual outbound information transfers, rather than only beaconing or command-and-control communications.

The number of victims and the identity of the specific criminal group responsible remain unknown.

The Attack Starts with a Command Pasted into Terminal

The observed compromise begins with an interactive zsh Terminal session. The mechanism is consistent with ClickFix, a social engineering technique that tricks users into copying and pasting commands into Terminal.

The command may be presented as a solution to a technical problem or as an instruction received through a website, message, application, file, or phone call. Believing they are running a diagnostic or applying a fix, the user instead launches the infection chain.

The initial step uses curl to download attacker-controlled content. Recurring paths include /curl/, sometimes followed by a token. The content is then processed with tools already available on the system, including Base64 and gunzip, allowing the payload to be decoded or decompressed without necessarily relying on conspicuous components.

osascript launches AppleScript-based components. The same sequence includes commands such as sh, cp, rm, and killall, which are used to execute scripts, move files, terminate processes, and remove traces.

The malware then collects local information, organizes it in temporary files, and prepares it for remote transmission. The sequence osascript → access to sensitive data → archive creation → outbound traffic is one of the key indicators for detection.

Credentials, Keys, and Personal Data in the Crosshairs

MacSync targets a broad range of information stored in a macOS account, including:

• host and user identification data;
• macOS Keychain contents;
• browser credentials and cookies;
• session data and browsing history;
• Apple Notes contents;
• SSH keys;
• AWS credentials;
• Kubernetes configurations;
• sensitive files in common user directories.

Security Affairs also reported that the malware searches for data associated with Ledger and Trezor wallets. This detail does not appear in Microsoft’s own list and should therefore be considered separately.

The impact can extend well beyond the individual Mac. AWS credentials, SSH keys, and Kubernetes configurations can provide access to cloud infrastructure, repositories, administrative systems, and development environments. Cookies and session tokens may enable attackers to abuse already authenticated accounts without necessarily needing the password.

Staging, Chunking, and Uploads via HTTP PUT

The stolen data is initially stored in temporary directories matching the /tmp/sync* pattern. MacSync then creates the /tmp/osalogging.zip archive.

The archive is split into multiple parts and transferred with curl through HTTP PUT requests. Microsoft observed the use of:

• --data-binary;
• headers containing an API key;
• macOS-style User-Agent strings;
• the upload_id parameter;
• the chunk_index parameter;
• the total_chunks parameter;
• paths such as /gate?buildtxd=;
• additional URIs, including /dynamic?txd=.

The combination of archiving, chunking, and PUT uploads confirmed that exfiltration was taking place. This was not simply an infection contacting a remote server: data was actually collected and transmitted.

After the transfer, the malware deletes temporary archives, staging directories, lock files, and other artifacts. This cleanup reduces persistent evidence on disk, but it does not necessarily remove the behavioral traces left by processes and network requests.

Microsoft’s published list includes these 31 domains:

aihealthring[.]com
cabinrentalsnc[.]com
chatbasedos[.]com
commercialroofingsd[.]com
dogtrainersgeorgia[.]com
fintelliganceai[.]com
homeinspectionsdelaware[.]com
intopython[.]com
lalandscapelighting[.]com
lumenagnet[.]com
marbellaresales[.]com
miamipcsupport[.]com
moldinspectiondayton[.]com
nailscanai[.]com
newjerseypetsitter[.]com
numericagent[.]com
oaklandwaterdamage[.]com
oklahomawarehousing[.]com
olympiapetemergency[.]com
peaecagent[.]com
plasmaticsystems[.]com
plethorawallet[.]com
premierrentalpurchase[.]com
ricewaterbeauty[.]com
rvieragent[.]com
sandiegotkd[.]com
secueragent[.]com
shiledagent[.]com
syracusefertilitycenter[.]com
vastbets[.]com
wvaeagent[.]com

The list represents indicators observed during a specific phase of the activity. It is not exhaustive and may quickly become outdated: hostname rotation makes a defense based solely on domain blocking ineffective.

Links to RST Cloud and ClickFix

Microsoft’s analysis expands on research published by RST Cloud on May 8. That research identified a static API key across four confirmed C2 domains and 11 additional candidate domains. It also documented the /dynamic?txd= and /gate?buildtxd= paths, along with rotation of the hexadecimal token associated with the build.

Some candidate domains showed overlapping transmission windows. This was consistent with parallel C2 operations rather than the strictly sequential replacement of hostnames.

Four domains now included in Microsoft’s list had already appeared among RST Cloud’s candidates:

• lalandscapelighting[.]com;
• lumenagnet[.]com;
• nailscanai[.]com;
• numericagent[.]com.

RST Cloud linked them to the URI patterns but did not classify them as confirmed through the API key because it lacked sufficient samples to verify that the static key matched. Microsoft confirms the recurring use of API key headers, but does not publish the static value cited in the earlier analysis or state that it is identical across all domains.

The operation is part of the broader ClickFix ecosystem targeting macOS. On August 5, 2026, Microsoft reported more than 250 front-end domains involved in a campaign distributing MacSync and Atomic Stealer, including through server-side browser fingerprinting.

The two sets should not be considered identical, however. It has not been established that the front-end domains from the broader campaign are the same 31 domains identified through behavioral pivots on MacSync.

How to Detect and Block the Infection Chain

Users should not paste commands into Terminal after receiving them from unverified webpages, chats, applications, files, or callers. A request to execute a lengthy zsh instruction is a warning sign, particularly when it appears during a purported support procedure.

From a defensive perspective, Microsoft recommends monitoring for:

• unusual Terminal, zsh, or shell sessions;
• downloads with curl followed by decoding or decompression;
• osascript executions;
• Keychain access after commands have been pasted by the user;
• files under /tmp/sync*;
• creation of /tmp/osalogging.zip;
• HTTP PUT requests using --data-binary;
• the upload_id, chunk_index, and total_chunks parameters;
• /gate and /dynamic URIs;
• traffic to suspicious or recently registered domains.

Processes, files, and network activity should be correlated rather than relying on a single indicator. Domains can change, while the malware’s operational sequence tends to leave more persistent patterns.

Apple also documents three protections available in macOS 26.4 and later: warnings against pasting into Terminal, blocking commands originating from the pasteboard, and scanning AppleScript scripts.

Twenty-four hours after the initial configuration, the Terminal warning is applied under specific conditions: when the user has not opened Terminal for more than 30 days, no common development tools are detected, and the content originates, for example, from a browser or messaging application.

XProtect can analyze the process tree generated by pasted commands, inspect network artifacts through Apple Safe Browsing Service, and block behaviors associated with known malware techniques. Apple also performs local inspection of AppleScript and JavaScript for Automation executions, including scripts loaded directly into memory.