MICROSOFT has warned that it is now tracking the MacSync stealer campaign by focusing on the malware’s behaviour instead of chasing its constantly changing domains. The macOS‑targeted information stealer harvests passwords, cryptocurrency keys and wallet data from infected machines, posing a direct threat to personal and corporate assets. Security teams must treat the activity as an active risk because the stealer is designed to exfiltrate high‑value secrets that can be used for further fraud or lateral movement.
Infection usually starts with a social engineering lure that convinces a victim to open Terminal and paste a malicious command. That command downloads a payload which then runs in the background, harvesting credentials from browsers, keychains and cryptocurrency applications. After exfiltrating the stolen material the malware deletes temporary files to hide its tracks, but it leaves behind recognizable patterns in network traffic and process execution. The use of legitimate macOS utilities makes the activity harder to spot with traditional signature‑based defences.
By correlating those behavioural artifacts across more than thirty domains linked to the operation, Microsoft’s analysts were able to build a detection signature that does not rely on a static URL or IP address, as detailed in Microsoft’s analysis. The pivots include specific user‑agent strings, uncommon file paths and regular beaconing intervals used by the stealer’s command‑and‑control channel. Analysts also noted consistent registry‑like plist modifications and the creation of hidden folders in user home directories. No CVE identifiers have been associated with this activity, reflecting the reliance on bespoke tools rather than known vulnerabilities.
The campaign appears to be active, with new domains appearing and disappearing within hours as the operators rotate infrastructure to evade reputation‑based blocks, a tactic highlighted in the SecurityAffairs report. Microsoft has not attributed the activity to any named threat actor, noting that the tactics resemble those used by financially motivated groups seeking quick profit from stolen credentials. The reliance on behavioural detection highlights a shift that many defenders must adopt as attackers increasingly use fast‑flux and domain generation techniques. Security researchers warn that similar methods are likely to spread to other malware families targeting macOS.
Defenders should start by reviewing endpoint logs for unusual Terminal launches, especially those that execute download commands or invoke unsigned binaries. Enforcing application control policies that restrict Terminal access to trusted users can reduce the chance of a successful lure. Updating anti‑malware rules to flag the observed user‑agent strings and beaconing intervals will help catch the stealer even when its domains change, advice echoed in the The Hacker News piece. Additionally, enabling process‑creation auditing and monitoring for outbound connections to newly registered domains provides another layer of visibility.
Organisations should also run regular user awareness sessions that explain how fake update pages or support scams can trick employees into running harmful commands. Maintaining offline backups of critical passwords and wallet files ensures that data loss from a successful theft is limited. Finally, integrating behavioural analytics into security information and event management platforms provides a longer‑term view of suspicious activity across the network, allowing analysts to spot low‑and‑slow exfiltration attempts before they cause major damage.