MacSync Stealer: Behavioral Pivots Across Rotating macOS Infostealer Infrastructure

MacSync Stealer is a macOS information stealer that treats its infrastructure as disposable. Earlier reporting by RST Cloud tracked it through a handful of domains and documented how quickly the command and control hosts were replaced after public disclosure. Microsoft Defender Experts approached it from the other direction, correlating recurring endpoint and network behaviors instead of domain names, and connected more than 30 domains that way. The domain count is the output of that method rather than the finding itself: what the investigation actually established is that the request shape, the execution pattern, the staging behavior, and the upload method all stayed constant while the hosting rotated underneath them.

Execution starts in an interactive shell, consistent with ClickFix social engineering where the user is talked into pasting a command into Terminal. That command retrieves the payload over the network and unwraps it locally. The payload then uses osascript to drive the rest of the chain through ordinary Unix utilities, so each step reads as a normal command rather than as script logic. Check-in traffic goes out with curl presenting a desktop browser identity and a reused API-key header. RST Cloud found that header token shared across confirmed command and control hosts while the per-deployment build token rotated.

Collection is broad and aimed at credentials that reach beyond the endpoint. The stealer inventories the host, looks for cryptocurrency wallet software, then takes macOS Keychain material, browser stores, developer and cloud credentials, and documents from user directories. Stolen data is staged in a temporary location, compressed into a single archive, and uploaded in numbered chunks over HTTP. The staging files are deleted afterwards.