MacSync Stealer Malware Infrastructure Mapped Using Behavioral Pivots

Microsoft Defender Experts have identified and mapped out the MacSync Stealer malware's infrastructure using behavioral pivots. The researchers correlated recurring endpoints and network behaviors across the activity to connect more than 30 domains, showing that the infrastructure extends beyond command-and-control (C2) communication, supporting active collection, staging, and exfiltration.

The investigation began with the identification of a macOS-focused information stealer known as MacSync Stealer. The malware relies on changing infrastructure to deliver payloads, communicate with compromised devices, and exfiltrate data. Microsoft Defender Experts expanded upon earlier reporting by RST Cloud, which identified the threat through a limited set of domains and documented rapid C2 replacement after public disclosure.

The researchers used a behavior-led approach, correlating recurring endpoints and network behaviors across the activity to connect more than 30 domains. This methodology showed that repeated request patterns and process behaviors create durable hunting opportunities, even when infrastructure is rotated quickly.