MacSync Stealer Uses 30+ Domains to Steal Passwords and Sensitive Mac Data

Key Takeaways

• MacSync Stealer is a sophisticated macOS malware campaign that leverages social engineering and over 30 rapidly changing domains to evade detection.
• The malware targets a wide range of sensitive user data, including browser credentials, Keychain access, crypto wallet information, cloud and SSH keys, and personal files.
• Attackers employ a “ClickFix” social engineering tactic, tricking users into executing malicious commands in their Terminal, bypassing standard security measures.
• Traditional domain blocklisting is ineffective against MacSync due to its dynamic infrastructure; behavioral analysis is crucial for detection.

A new threat, MacSync Stealer, is significantly escalating the risk for macOS users by transforming routine online activity and Terminal commands into avenues for extensive data theft. This macOS-specific malware employs a highly agile network infrastructure, rotating through more than 30 domains, which severely undermines the efficacy of conventional blocklists and leaves victims vulnerable to account compromise, financial losses, and the exposure of private information.

The attack typically commences with a social engineering technique dubbed “ClickFix.” Victims are manipulated into pasting a malicious command into their Terminal application, often after encountering deceptive prompts for verification, software downloads, or technical support. This command then fetches the attacker’s payload, a method reminiscent of other recent macOS ClickFix attacks that have exploited bogus CAPTCHA checks to trick users.

Microsoft said in a report shared with Cyber Security News (CSN) that its researchers meticulously tracked this activity, from the initial command-and-control (C2) communication to data collection, temporary storage, and exfiltration. Despite the rapid shifts in the malware’s infrastructure, Microsoft’s analysis revealed consistent network and execution characteristics that linked the operation to over 30 distinct domains.

The consequences of a MacSync infection extend far beyond a single compromised password. The stealer systematically targets browser data, macOS Keychain contents, cloud service and SSH credentials, cryptocurrency wallet artifacts, Apple Notes, session tokens, and sensitive files located in common user directories. This trove of stolen data can grant malicious actors unauthorized access to personal accounts or establish a persistent foothold within corporate networks.

MacSync Stealer’s Evasive Infrastructure

The core of this campaign’s resilience lies in the operator’s strategy of constantly rotating domains. When one domain is identified and blocked, another is swiftly deployed to deliver payloads, receive check-ins, or collect exfiltrated archives. This dynamic approach renders investigations that rely solely on known malicious domains largely ineffective, echoing challenges observed in other large-scale macOS ClickFix operations reported recently.

Rather than focusing on ephemeral domains, Microsoft researchers successfully correlated the disparate servers by identifying repeatable behavioral patterns. They observed identical request paths, macOS-specific browser identifiers, consistent API-key headers, specific curl options, and chunked upload methods across the various domains. This behavioral consistency provided defenders with a robust mechanism to recognize the campaign, even as its network addresses changed.

Upon successful execution, MacSync leverages native macOS utilities to blend its operations with legitimate system activity. It initiates from an interactive zsh shell session, uses the curl command-line tool to retrieve malicious content, and can employ Base64 encoding, gunzip decompression, and AppleScript-assisted commands to unpack and run its components. This tactic mirrors a previous Script Editor ClickFix campaign designed to bypass user security prompts.

The malware then proceeds to harvest critical information from web browsers and the local file system. It specifically targets data related to Ledger and Trezor cryptocurrency hardware wallets, extracts browser credentials and cookies, and searches for cryptographic keys, configuration files, and other sensitive documents. Furthermore, it scans common directories like Downloads, Documents, and Desktop for file types that might contain passwords, recovery phrases, or proprietary business information.

Data Theft and Defense Steps

Once data collection is complete, MacSync temporarily stores the gathered material in transient folders and compresses it into an archive before exfiltration. This archive is subsequently split into smaller segments and uploaded via HTTP PUT requests. Following successful exfiltration, the malware meticulously deletes all temporary files and directories. This precise sequence of actions clearly indicates data theft rather than routine server communication.

For cybersecurity professionals, the most effective detection strategy involves analyzing the entire chain of events rather than focusing on isolated suspicious domains. A sequence comprising an unusual Terminal or shell session, followed by curl downloads, AppleScript activity, access to password stores, the creation of archives in temporary paths, and subsequent outbound uploads, collectively represents a strong indicator of compromise. Similar credential-focused threats, such as the recently discovered macOS crash report stealer, underscore the importance of such linked evidence.

What You Should Do

• Exercise Extreme Caution with Terminal Commands: Never paste commands into your Terminal application from untrusted websites, chat messages, applications, files, or verbal instructions. Always verify the source and purpose of any command before execution.
• Implement Security Awareness Training: Organizations should educate employees on recognizing social engineering lures, especially those attempting to trick users into executing commands or downloading suspicious files.
• Monitor for Anomalous Activity: Security teams should actively monitor for unexpected shell and osascript (AppleScript) activity, as well as curl traffic associated with outbound data uploads.
• Restrict Outbound Connections: Implement network policies to restrict suspicious outbound connections, particularly to unknown or unusual domains.
• Protect Password Stores: Employ strong, unique passwords for all accounts and leverage password managers. Protect the macOS Keychain with robust access controls.
• Keep Systems Updated: Ensure macOS and all security software are kept up-to-date with the latest patches and definitions to benefit from Apple’s newer protections against malicious Terminal pastes and scripts.
• Investigate Data Staging Alerts: Thoroughly investigate any security alerts related to data staging, temporary file creation, or unusual archiving activities.
• Post-Compromise Procedures: In the event of a suspected compromise, immediately reset all affected passwords from a clean, uncompromised device. Revoke all active sessions and replace any exposed cloud or SSH credentials.

Apple’s recent security enhancements can provide warnings about potentially harmful Terminal pastes and block known malicious scripts. However, these features are not a substitute for user vigilance and robust security practices. The MacSync campaign serves as a critical reminder that seemingly innocuous prompts can lead to severe security consequences.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.