Microsoft’s security team reports that it linked more than 30 web domains to MacSync Stealer, a macOS-focused information stealer. The key point is that the domains did not behave like one static command-and-control endpoint. Instead, Microsoft states that recurring patterns across endpoints and network traffic made it possible to connect infrastructure that kept changing.
The company’s investigation tracked the malware end-to-end—from how the payload is fetched to how data is staged, archived, and sent out. Microsoft also emphasizes that it observed active data exfiltration, not just “beaconing” signals.
Why rotating infrastructure was still traceable
According to Microsoft, it did not treat a domain as connected based on a single observable artifact. The researchers looked for multiple endpoint and network behaviors that had to align. That alignment included process context, command-line patterns, and details of how HTTP requests were shaped (such as paths, headers, and upload-related parameters).
In other words, even when hostnames changed, Microsoft says the malware’s “behavioral fingerprints” remained consistent enough to group the domains. The team describes the approach as correlating execution context with request structure as infrastructure evolves.
From zsh to payload retrieval: the observed execution flow
The execution chain begins when activity is consistent with a user-driven interactive terminal session. Microsoft notes that the process was consistent with a social engineering approach associated with ClickFix. Shortly after the terminal interaction, the analysis reports that curl retrieved attacker-controlled content using a recurring /curl/ request path.
After retrieval, the malware uses macOS and Unix-native tools in a way that Microsoft says is characteristic. The payload decoding and unpacking steps include utilities such as Base64 and gunzip, suggesting staged payload processing rather than a single-step download and execute.
AppleScript-assisted execution and native utilities
A notable part of Microsoft’s analysis is the use of osascript to run AppleScript. The malware then combines this AppleScript-assisted execution with macOS and Unix tools to carry out subsequent actions.
Microsoft describes the flow as a transition from payload handling into systematic collection of host, user, and application data. That collection goes beyond basic system information.
What MacSync Stealer collects from macOS systems
Microsoft reports that MacSync Stealer gathers a wide range of sensitive information. The observed targets include:
- Host and user details
- macOS Keychain material
- Browser credentials and cookies
- Session data
- Apple Notes content
- SSH keys (Secure Shell keys)
- AWS credentials
- Kubernetes configurations
- Browser history
- Sensitive files from common user directories
On the staging side, Microsoft says collected data is saved under temporary locations such as /tmp/sync*. The data is compressed into an archive (for example, /tmp/osalogging.zip), then split into chunks and prepared for chunked uploads.
Staging, chunking, and HTTP PUT uploads
Instead of sending one large file, Microsoft reports that the malware uploads data in multiple segments. The staging artifacts are managed with temporary archive files and folders, and the upload process uses curl with HTTP PUT requests.
Microsoft highlights recurring parameters used during upload, such as upload_id, chunk_index, and total_chunks. These parameters appear alongside recurring path traits and other request-shape characteristics.
After exfiltration, the malware attempts to clean up. Microsoft says it removes temporary archives, staging folders, lock files, and other artifacts—actions that can reduce forensic traces on the system.
Security researchers previously mapped related C2 patterns
Microsoft’s disclosure builds on earlier analysis associated with RST Cloud (including findings dated May 8). That earlier work described patterns tied to known command-and-control domains, including a static API key across domains that were confirmed.
RST Cloud also discussed additional candidate domains identified through recurring URI patterns, including patterns such as /dynamic?txd= and /gate?buildtxd=. In that context, RST Cloud suggested that overlapping submission windows were consistent with parallel operation rather than strict, sequential rotation between hostnames.
Microsoft also compares its new set with indicator sets published by The Hacker News and notes overlap with some of the domains that RST Cloud had categorized in a URI-pattern-bound way.
What Microsoft says makes these MacSync Stealer domains stand out
Microsoft attributes the linkage to recurring network traits paired with endpoint context. In addition to the /curl/ path and the dynamic/gate URI patterns, the company points to:
- macOS User-Agent strings
- API-key headers (described as a recurring trait)
- HTTP PUT uploads using consistent chunk-management parameters
Importantly, Microsoft’s report says it used these request shapes together with execution context to identify related infrastructure even as the domains changed. That is the core idea behind connecting MacSync Stealer domains despite infrastructure churn.
Domain indicators Microsoft observed (time-specific list)
Microsoft shared a point-in-time set of domain indicators observed in activity consistent with MacSync Stealer. The list includes many web domains, such as:
- aihealthring[.]com
- cabinrentalsnc[.]com
- chatbasedos[.]com
- commercialroofingsd[.]com
- dogtrainersgeorgia[.]com
- fintelliganceai[.]com
- homeinspectionsdelaware[.]com
- intopython[.]com
- lalandscapelighting[.]com
- lumenagnet[.]com
- marbellaresales[.]com
- miamipcsupport[.]com
- moldinspectiondayton[.]com
- nailscanai[.]com
- newjerseypetsitter[.]com
- numericagent[.]com
- oaklandwaterdamage[.]com
- oklahomawarehousing[.]com
- olympiapetemergency[.]com
- peaecagent[.]com
- plasmaticsystems[.]com
- plethorawallet[.]com
- premierrentalpurchase[.]com
- ricewaterbeauty[.]com
- rvieragent[.]com
- sandiegotkd[.]com
- secueragent[.]com
- shiledagent[.]com
- syracusefertilitycenter[.]com
- vastbets[.]com
- wvaeagent[.]com
Because these are described as time-specific indicators, defenders should treat them as one piece of a broader detection strategy—especially when domains can change again.
Actionable steps for organizations
Microsoft advises organizations to focus on both user behavior and technical signals in the environment. Recommended steps include:
- Educate users not to paste or run Terminal commands from untrusted websites, chat messages, apps, files, or phone-based instructions.
- Monitor unusual Terminal and zsh activity that retrieves payloads, decodes content, or executes commands shortly after user interaction.
- Correlate AppleScript-assisted activity with credential-store access, archive creation in temporary paths, and subsequent outbound network traffic.
- Inspect curl-based HTTP PUT uploads for characteristics such as –data-binary, API-key headers, upload identifiers, chunk indexes, total chunk counts, and recurring gate URI patterns.
- Investigate connections to suspicious or newly registered domains while also hunting for the process and request patterns that may persist even after infrastructure changes.
Mac protections that may reduce risk on newer macOS versions
Apple has documented three protections available on macOS 26.4 and later: Terminal paste protection, pasteboard command blocking, and AppleScript scanning.
Microsoft notes that after a grace period following initial setup, Terminal warnings can apply when certain conditions are met, including when Terminal hasn’t been opened for more than 30 days, no common developer tooling is detected, and the pasted content originates from a specified application such as a web browser or messaging app.
The protections also cover tracing process trees produced by pasted commands and checking related network artifacts against Apple’s Safe Browsing Service. Additionally, AppleScript and JavaScript for Automation executions are inspected locally, including scripts executed directly from memory.
What this means for defenders
This disclosure underscores a common reality in modern macOS malware operations: infrastructure can rotate, but behavior patterns tend to repeat. Microsoft’s analysis shows that defenders can still connect domains when they correlate endpoint execution context with request-shape signals like URI paths and chunked upload parameters.
For practical security, the most useful approach is to look beyond domain names alone. Combine user education with monitoring for suspicious Terminal/zsh activity, AppleScript-assisted execution, temporary archive staging, and the specific mechanics of chunked HTTP PUT uploads.
By treating MacSync Stealer domains as indicators within a larger behavioral model, organizations can improve detection even when attackers change hostnames and infrastructure details.
Source: https://thehackernews.com/2026/08/microsoft-links-30-rotating-domains-to.html
