Microsoft Details MacSync Stealer's Evolving Infrastructure and Hunting Techniques
Microsoft Defender Experts have identified and analyzed MacSync Stealer, a macOS information stealer that employs rapidly rotating infrastructure, detailing its attack chain and providing behavioral indicators for more durable threat hunting.
Microsoft Defender Experts have identified MacSync Stealer, a sophisticated information-stealing malware targeting macOS, by analyzing recurring network behaviors and execution patterns. This analysis has expanded the understanding of the threat beyond previously reported limited domain sets, connecting over 30 domains used for command-and-control (C2) communication, payload delivery, and data exfiltration. The malware's reliance on rapidly changing infrastructure, a tactic noted by previous researchers, is countered by persistent technical traits that enable more robust detection and hunting.
The attack chain begins with social engineering, often involving users being tricked into pasting or running commands in a Terminal session, consistent with techniques like ClickFix. From this interactive shell, the malware uses curl to retrieve attacker-controlled payload content, which is then executed via scripts. Following execution, the MacSync Stealer communicates with its C2 infrastructure using a consistent set of indicators. These include recurring URI paths, specific macOS User-Agent strings, API-key headers, and particular curl command-line options. These behavioral pivots remain constant even as the underlying domains are frequently replaced, providing defenders with durable hunting opportunities.
MacSync Stealer's capabilities extend to actively collecting sensitive data from compromised macOS devices. The malware targets critical information stored in the macOS Keychain, browser data, locally stored credentials, cloud and Secure Shell (SSH) credentials, and other sensitive files found in common user directories. The investigation confirmed that the malware not only beacons to C2 servers but also actively exfiltrates the collected data. This exfiltration process involves staging the collected data under temporary paths, compressing it into an archive, splitting it into manageable chunks, and uploading these chunks via HTTP PUT requests using curl with the --data-binary argument.
Microsoft Defender Experts expanded the known infrastructure by correlating multiple endpoint and network behaviors across payload retrieval, C2 check-ins, and exfiltration phases. This rigorous methodology linked more than 30 domains, emphasizing that the number of domains is a consequence of the behavioral analysis rather than the primary finding. The most effective hunting pivots combined network request characteristics with endpoint execution context. Recurring URI patterns such as /curl/, /dynamic?txd=, and /gate?buildtxd= were identified, alongside specific curl command-line arguments like -k, -s, --max-time, and --data-binary, consistent macOS User-Agent strings, and API-key headers.
Additional hunting opportunities arise from the chunked exfiltration process. Parameters such as upload_id, chunk_index, and total_chunks within the HTTP PUT requests provide further telemetry that can be correlated across process, command-line, file, and network events. This detailed understanding of the attack chain, from initial execution to data exfiltration, allows defenders to track the malware's activity even when its infrastructure is in flux. The findings reinforce a critical lesson for defenders: while rotating infrastructure can thwart static domain blocking, consistent execution patterns and request behaviors offer more enduring methods for detecting and investigating threats like MacSync Stealer.
The observed MacSync Stealer activity follows a rapid, script-driven attack chain designed for swift execution on macOS. Its primary goal is to collect high-value local data, stage it, and exfiltrate the archive through its dynamic web infrastructure. Each phase of this attack chain generates distinct telemetry, enabling correlation across various security event logs. By focusing on these recurring technical traits rather than solely on domain names, security teams can build more resilient defenses against this evolving macOS threat.
While the article does not assign specific CVEs to MacSync Stealer, its focus on information stealing and the use of evolving infrastructure aligns with broader trends in macOS malware. The techniques described, such as leveraging curl for C2 and exfiltration and employing behavioral pivots for hunting, are crucial for organizations looking to protect their macOS endpoints from sophisticated threats. Microsoft provides mitigation and protection guidance, urging users to maintain up-to-date security software and be vigilant against social engineering tactics.