Overview
- Microsoft disclosed Wednesday that Defender Experts correlated recurring process ancestry, command-line patterns, request paths, headers, and upload parameters to map more than 30 rotating domains to the MacSync Stealer campaign.
- The infection starts with ClickFix social engineering that tricks users into pasting and running Terminal commands which spawn interactive zsh sessions that use curl to retrieve attacker payloads.
- Once running, the stealer hunts high-value secrets including macOS Keychain items, saved browser credentials, SSH keys, cloud credentials, Kubernetes configs, and Ledger/Trezor wallet files.
- Researchers observed collected data staged under temporary paths, compressed into an archive, split into chunks, and exfiltrated with curl using HTTP PUT requests that include upload_id, chunk_index, total_chunks and API-key headers.
- Microsoft and prior RST Cloud research recommend defenders stop relying on domain blocklists and instead monitor Terminal and osascript activity, curl PUT uploads, /tmp/sync* staging, and enable macOS 26.4+ protections while continuing behavioral hunting.