MacSync Stealer Behavioral Hunting and Infrastructure Analysis

MacSync Stealer is an information-stealing malware specifically targeting macOS environments. First identified by RST Cloud, the malware is notable for its use of rapidly rotating command-and-control (C2) infrastructure to evade static domain-based detection. Microsoft Defender Experts expanded the understanding of this threat by correlating recurring endpoint and network behaviors, uncovering more than 30 related domains. The malware typically initiates via ClickFix social engineering, where users are manipulated into executing malicious shell commands in Terminal. Once active, the stealer exhibits durable behavioral traits - including specific URI paths, curl command-line arguments, and unique HTTP header parameters - that persist regardless of the underlying domain. These patterns support a full lifecycle of collection, staging, and exfiltration of sensitive macOS data, including Keychain material, browser credentials, and SSH keys.

Attack Chain

1. Initial access is achieved via ClickFix social engineering, prompting the user to paste and execute malicious commands in a Terminal session.
2. The interactive shell session invokes curl to fetch the primary payload from attacker-controlled infrastructure using paths containing /curl/.
3. The malware performs C2 check-ins using curl with consistent flags (-k, -s, --max-time), specific macOS User-Agent strings, and a static api-key header.
4. The stealer performs local discovery to identify Keychain files, browser profile data, cloud credentials, and SSH keys stored in user directories.
5. Collected sensitive data is moved to temporary directories and compressed into a single archive file.
6. The archive is split into smaller chunks, which are exfiltrated using curl via HTTP PUT requests with the --data-binary flag.
7. Exfiltration traffic is identified by unique URL parameters including upload_id, chunk_index, and total_chunks mapped to /gate?buildtxd= URI patterns.
8. Final cleanup occurs as the malware deletes temporary staging folders, compressed archives, and associated lock files to minimize forensic artifacts.

Impact

MacSync Stealer poses a high risk to macOS users by facilitating the theft of high-value credentials, including browser-stored logins, cloud service tokens, and SSH keys. If the attack succeeds, attackers gain persistent unauthorized access to the victim's digital accounts and local development environments. While specific victim counts are not disclosed, the threat's capability to exfiltrate vast amounts of sensitive local data makes it a significant risk to individuals and enterprise users on the macOS platform.

Recommendation

• Deploy the Sigma rule below to detect execution of curl commands containing known MacSync Stealer URI patterns and command-line flags.
• Monitor process execution logs for curl sessions that utilize the --data-binary flag in conjunction with PUT requests, as these are highly indicative of exfiltration.
• Implement endpoint controls to restrict the execution of untrusted commands in Terminal, specifically monitoring for base64-encoded or obfuscated script injection characteristic of ClickFix campaigns.
• Configure network monitoring to alert on HTTP headers containing the api-key string when used in conjunction with macOS User-Agent strings in non-standard environments.