Microsoft Ditches Domain Blocking for Behavioral Analysis in MacSync Stealer Fight

Microsoft has discovered a new approach to combating MacSync Stealer malware, which targets Apple devices. Instead of focusing on blocking domains used by the malware, Microsoft's Defender Experts tracked over 30 domains by analyzing behavioral patterns.

The malware, which steals sensitive information such as passwords and cryptocurrency wallets, was initially distributed via ClickFix scams. Victims would visit a malicious website that claimed to have identified a problem with their browser or documents, and then offered a solution that deployed the malware.

Initially, defenders tried blocking the domains used by the malware, but new domains would constantly pop up, allowing the malware to continue its operations. Microsoft's behavior-led approach connected more than 30 domains and showed that the infrastructure supported not only C2 communication, but also active collection, staging, and exfiltration.

To defend against MacSync Stealer, Microsoft recommends paying attention to shell sessions spawning 'curl' with specific flag combinations, osascript quickly chaining into network activity, and archives appearing under /tmp/sync just before outbound PUT traffic begins.