Microsoft Uncovers 30+ Domains Linked to MacSync Stealer Infrastructure

"The investigation also confirmed active data exfiltration, not just beaconing," the company said.

Microsoft links 30+ rotating domains to MacSync Stealer

Microsoft Defender Experts published an analysis on August 18 that links more than 30 web domains to MacSync Stealer, a macOS-focused information stealer, after correlating recurring endpoint and network behaviors as infrastructure changed. The company said it required multiple endpoint and network behaviors to align before treating a domain as connected, including process ancestry, command-line patterns, request paths, headers, and upload parameters.

Microsoft provided a point-in-time set of 31 domain indicators observed in activity consistent with MacSync Stealer: aihealthring[.]com, cabinrentalsnc[.]com, chatbasedos[.]com, commercialroofingsd[.]com, dogtrainersgeorgia[.]com, fintelliganceai[.]com, homeinspectionsdelaware[.]com, intopython[.]com, lalandscapelighting[.]com, lumenagnet[.]com, marbellaresales[.]com, miamipcsupport[.]com, moldinspectiondayton[.]com, nailscanai[.]com, newjerseypetsitter[.]com, numericagent[.]com, oaklandwaterdamage[.]com, oklahomawarehousing[.]com, olympiapetemergency[.]com, peaecagent[.]com, plasmaticsystems[.]com, plethorawallet[.]com, premierrentalpurchase[.]com, ricewaterbeauty[.]com, rvieragent[.]com, sandiegotkd[.]com, secueragent[.]com, shiledagent[.]com, syracusefertilitycenter[.]com, vastbets[.]com, and wvaeagent[.]com.

Observed execution and the data pipeline

Microsoft's telemetry traces an execution chain beginning from an interactive zsh Terminal session it described as consistent with ClickFix social engineering. The sequence includes curl retrieving attacker-controlled content over a recurring /curl/ path; use of native utilities such as Base64 and gunzip to decode or unpack payloads; and osascript to enable AppleScript-assisted execution alongside other macOS and Unix utilities.

Once active, the payload collects a broad set of targets: host and user information, macOS Keychain material, browser credentials and cookies, session data, Apple Notes, Secure Shell (SSH) keys, Amazon Web Services (AWS) credentials, Kubernetes configurations, browser history, and sensitive files from common user directories. Collected data is staged under /tmp/sync*; compressed into /tmp/osalogging.zip; split into multiple chunks; and uploaded with curl through HTTP PUT requests that carry recurring parameters such as upload_id, chunk_index, and total_chunks. After exfiltration the malware removes temporary archives, staging folders, lock files, and other artifacts.

RST Cloud overlap and the lingering API-key question

The Microsoft disclosure builds on a May 8 analysis by RST Cloud, which documented a static API key across four confirmed command-and-control domains and identified 11 additional candidate domains through recurring /dynamic?txd= and /gate?buildtxd= URI patterns. RST Cloud noted several candidates had overlapping submission windows and described that behavior as consistent with parallel C2 operation rather than strict sequential rotation: "The hex build token rotates per deployment, the api-key does not," RST Cloud said.

A comparison by The Hacker News found four domains in Microsoft's list — lalandscapelighting[.]com, lumenagnet[.]com, nailscanai[.]com, and numericagent[.]com — also appeared in RST Cloud's May candidate cluster. Microsoft refers to API-key headers as a recurring MacSync trait but did not publish the static API-key value RST Cloud documented, nor did it state that the same value appears across every domain in the current set.

Microsoft’s operational guidance and Apple's protections

Microsoft advised organizations to take several concrete detection and prevention steps:

• Educate users not to paste or run Terminal commands from untrusted websites, chat messages, apps, files, or phone-based instructions.
• Monitor unusual Terminal, zsh, and shell sessions that retrieve payloads, decode content, or execute commands shortly after user interaction.
• Correlate AppleScript-assisted shell activity with credential-store access, archive creation under temporary paths, and subsequent outbound traffic.
• Monitor curl-based HTTP PUT uploads using --data-binary, API-key headers, upload identifiers, chunk indexes, total chunk counts, and recurring /curl/, /dynamic?txd=, and /gate?buildtxd= URI patterns.
• Investigate connections to suspicious or newly registered domains while continuing to hunt for the request and process patterns that may persist after infrastructure changes.

Separately, Apple has documented three protections available on macOS 26.4 and later: Terminal paste protection, pasteboard command blocking, and AppleScript scanning. The Terminal warning applies after a 24-hour grace period following initial system setup when the user has not opened Terminal in more than 30 days, no common developer tooling is detected, and the paste originates from specified applications such as a web browser or messaging app. Apple said XProtect can trace the process tree produced by pasted terminal commands, check associated network artifacts against Apple's Safe Browsing Service, and block behavior that matches known malware techniques; AppleScript and JavaScript for Automation executions are inspected locally, including scripts executed directly from memory.

What this means for technologists, enterprises, and end users

Technologists and security teams should instrument detection across both endpoint and network telemetry: watch for interactive zsh sessions that promptly download content via /curl/, AppleScript-assisted execution, creation of /tmp/osalogging.zip, and curl HTTP PUT uploads carrying upload_id, chunk_index, and total_chunks parameters.

Affected enterprises and procurement leaders should investigate connections to newly registered or suspicious domains listed in Microsoft’s indicators and correlate those network contacts with local artifacts and credential-store access rather than relying solely on static host lists.

End users should heed Microsoft's basic guidance: do not paste or run Terminal commands from untrusted sources, and be aware that macOS 26.4+ includes Terminal paste protections and local AppleScript inspection that can interrupt this attack chain.

Microsoft's behavioral pivots link a shifting set of hostnames to an active macOS-focused stealer, and the company emphasizes patterns — not single indicators — as the reliable signal. The record also highlights an outstanding technical detail: while RST Cloud reported a static API key across early C2 domains, Microsoft did not publish that value or confirm it appears across the current domain set, leaving that particular linkage subject to further validation.

https://thehackernews.com/2026/08/microsoft-links-30-rotating-domains-to.html