Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure

Summary

Microsoft Defender Experts have identified over 30 web domains associated with MacSync Stealer, a malware targeting macOS systems. By correlating endpoint and network behaviors, Microsoft traced the malware's lifecycle from initial retrieval to data exfiltration. The investigation confirmed active data exfiltration, not just beaconing, and highlighted the use of social engineering and native utilities for execution and data collection.

Full text

Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure Swati KhandelwalAug 19, 2026Malware / Cloud Security Microsoft Defender Experts have linked more than 30 web domains to MacSync Stealer, a macOS-focused information stealer, after correlating recurring endpoint and network behaviors across changing infrastructure, tracing the malware from payload retrieval through data collection, staging, and exfiltration. The tech giant said it required multiple endpoint and network behaviors to align before treating a domain as connected, including process ancestry, command-line patterns, request paths, headers, and upload parameters. Microsoft did not disclose a victim count or attribute the activity to a named threat actor in the report published Tuesday. "The investigation also confirmed active data exfiltration, not just beaconing," the company said. According to the analysis, observed execution began from an interactive zsh Terminal session consistent with ClickFix social engineering, followed by curl retrieving attacker-controlled content over a recurring /curl/ path and native utilities such as Base64 and gunzip decoding or unpacking the payload. The payload uses osascript for AppleScript-assisted execution alongside native macOS and Unix utilities, before collecting host and user information, macOS Keychain material, browser credentials and cookies, session data, Apple Notes, Secure Shell (SSH) keys, Amazon Web Services (AWS) credentials, Kubernetes configurations, browser history, and sensitive files from common user directories. Collected data is staged under /tmp/sync*, compressed into /tmp/osalogging.zip, split into multiple chunks, and uploaded with curl through HTTP PUT requests using recurring parameters such as upload_id, chunk_index, and total_chunks. The malware removes temporary archives, staging folders, lock files, and other artifacts after exfiltration. The disclosure builds on RST Cloud's May 8 analysis, which documented a static API key across four confirmed command-and-control (C2) domains and identified 11 additional candidate domains through recurring /dynamic?txd= and /gate?buildtxd= URI patterns. Several candidates had overlapping submission windows, which RST Cloud said was consistent with parallel C2 operation rather than strict sequential rotation between hostnames. "The hex build token rotates per deployment, the api-key does not," RST Cloud said. A comparison of the two published indicator sets by The Hacker News found that four domains Microsoft now lists, lalandscapelighting[.]com, lumenagnet[.]com, nailscanai[.]com, and numericagent[.]com, also appeared in RST Cloud's May candidate cluster. RST Cloud classified those domains as URI-pattern bound rather than API-key confirmed because it had not retrieved samples from each candidate to validate the static API-key match. Microsoft refers to API-key headers as a recurring MacSync trait, but its August 18 post does not publish the static value documented by RST Cloud or state that the same value appears across every domain in the current set. Microsoft said the recurring network traits include the /curl/, /dynamic?txd=, and /gate?buildtxd= paths, macOS User-Agent strings, API-key headers, and HTTP PUT uploads carrying the same chunk-management parameters. The researchers used those request shapes together with endpoint execution context to identify related infrastructure as the domains changed. Microsoft shared the following point-in-time domain indicators observed in activity consistent with MacSync Stealer - aihealthring[.]com cabinrentalsnc[.]com chatbasedos[.]com commercialroofingsd[.]com dogtrainersgeorgia[.]com fintelliganceai[.]com homeinspectionsdelaware[.]com intopython[.]com lalandscapelighting[.]com lumenagnet[.]com marbellaresales[.]com miamipcsupport[.]com moldinspectiondayton[.]com nailscanai[.]com newjerseypetsitter[.]com numericagent[.]com oaklandwaterdamage[.]com oklahomawarehousing[.]com olympiapetemergency[.]com peaecagent[.]com plasmaticsystems[.]com plethorawallet[.]com premierrentalpurchase[.]com ricewaterbeauty[.]com rvieragent[.]com sandiegotkd[.]com secueragent[.]com shiledagent[.]com syracusefertilitycenter[.]com vastbets[.]com wvaeagent[.]com Microsoft advised organizations to perform the following steps - Educate users not to paste or run Terminal commands from untrusted websites, chat messages, apps, files, or phone-based instructions. Monitor unusual Terminal, zsh, and shell sessions that retrieve payloads, decode content, or execute commands shortly after user interaction. Correlate AppleScript-assisted shell activity with credential-store access, archive creation under temporary paths, and subsequent outbound traffic. Monitor curl-based HTTP PUT uploads using --data-binary, API-key headers, upload identifiers, chunk indexes, total chunk counts, and recurring /gate URI patterns. Investigate connections to suspicious or newly registered domains while continuing to hunt for the request and process patterns that may persist after infrastructure changes. Apple has separately documented three protections available on macOS 26.4 and later: Terminal paste protection, pasteboard command blocking, and AppleScript scanning. After a 24-hour grace period following initial system setup, the Terminal warning applies when the user has not opened Terminal in more than 30 days, no common developer tooling is detected, and the paste originates from a specified application such as a web browser or messaging app. XProtect can trace the process tree produced by pasted terminal commands, check associated network artifacts against Apple's Safe Browsing Service, and block behavior that matches known malware techniques. AppleScript and JavaScript for Automation executions are also inspected locally, including scripts executed directly from memory. The disclosure comes less than two weeks after Microsoft said it had confirmed more than 250 front-end domains in a macOS ClickFix campaign distributing MacSync and Atomic Stealer (AMOS) behind a server-side browser-fingerprinting gate. The August 18 report does not state that those front-end domains are the same infrastructure set as the more than 30 domains identified through the MacSync behavioral pivots. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Cloud security, Credential Theft, data theft, endpoint security, Information Stealer, macos security, Malware, Microsoft, Social Engineering, Threat Intelligence ⚡ Top Stories This Week Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations Researchers Report 84 Flaws in 4G and 5G Cores, Including a Session Hijacking Flaw Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks Claude Mythos 5 Tried to Backdoor a Real Open-Source Project in Testing, Then Vouched for Itself Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup Poison Claude Sells Discounted Claude Access While Its Operator Sees Every Customer Prompt Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses ThreatsDay: Odysseus RCE, Samsung One-Click Takeover, iCloud Backdoor Fight + 27 More Stories New Interrupt Injection Attack Can Bypass Spectre v2 Defenses on Intel and AMD CPUs New Zapscape KV

Indicators of Compromise

• domain — olympiapetemergency[.]com
• domain — lalandscapelighting[.]com
• domain — lumenagnet[.]com
• domain — nailscanai[.]com
• domain — numericagent[.]com
• domain — aihealthring[.]com
• domain — cabinrentalsnc[.]com
• domain — chatbasedos[.]com
• domain — commercialroofingsd[.]com
• domain — dogtrainersgeorgia[.]com
• domain — fintelliganceai[.]com
• domain — homeinspectionsdelaware[.]com
• domain — intopython[.]com
• domain — marbellaresales[.]com
• domain — miamipcsupport[.]com
• domain — moldinspectiondayton[.]com
• domain — newjerseypetsitter[.]com
• domain — oaklandwaterdamage[.]com
• domain — oklahomawarehousing[.]com

Entities