Microsoft Tracks MacSync Stealer by Its Behavior

Microsoft's researchers have been tracking a macOS-focused information stealer called MacSync Stealer. The malware uses changing infrastructure to evade detection, making it difficult for defenders to keep up with its domains.

The team decided to focus on the behavior patterns of the malware instead of individual domains. By analyzing recurring request patterns, HTTP headers, and other behaviors, they were able to link over 30 domains to the same campaign.

The MacSync Stealer infection chain starts with a social engineering trick called ClickFix, which tricks victims into pasting or running commands in macOS Terminal. The malware then uses native macOS tools to decode and unpack the payload, before an AppleScript-driven layer takes over.

Once active, the stealer focuses on valuable data, looking for macOS Keychain data, saved browser passwords and cookies, SSH keys, AWS credentials, Kubernetes configurations, and files in common user folders. It also searches for Ledger and Trezor wallet data.