01ClickFix-style Terminal execution starts the chain
Observed execution begins from an interactive macOS shell session consistent with a paste-and-run social-engineering workflow.
Useful logs: Endpoint, Process
Threat report
MacSync Stealer in 2026: Behavior Survives Domain Rotation
MacSync rotates infrastructure quickly, but shell retrieval, AppleScript, credential collection, temporary staging, chunked curl uploads, and cleanup remain durable hunting pivots.
Public research
Reported facts and defensive takeaways are labeled separately.
- Reviewed
Public reporting
What happened
MacSync is a macOS-focused information stealer that uses fast-changing web infrastructure for payload delivery, command-and-control, and exfiltration. Microsoft expanded earlier infrastructure research by correlating repeated endpoint and request behaviors, linking more than thirty domains and confirming collection, staging, chunked upload, and cleanup.
- Hunting MacSync Stealer infrastructure through behavioral pivots
- MacSync Stealer: C2 Infrastructure Rotation
Why SOC teams should care
Static domain blocking ages quickly in this activity. The stronger defensive surface is the repeated sequence: interactive shell and curl retrieval, AppleScript-assisted execution, credential and user-data collection, temporary staging, archive creation, chunked binary upload, and evidence removal.
Public reporting
How the attack worked
Initial Access Execution 02curl retrieves and native tools unpack payload content
curl reaches a recurring retrieval path and native utilities decode or unpack the staged content.
Useful logs: Process, Network
Execution 03AppleScript assists native shell activity
osascript drives shell and native utilities including copy, removal, retrieval, directory creation, and process-control actions.
Useful logs: Process
Credential Access 04Credential and browser stores are collected
The malware targets Keychain material, browser credentials and sessions, SSH keys, cloud credentials, and other locally stored secrets.
Useful logs: Process, File
Collection 05Collected material is staged and compressed
Sensitive data is copied into temporary sync staging and compressed before transfer.
Useful logs: Process, File
Exfiltration 06curl uploads the archive in chunks
Binary HTTP PUT requests carry upload session, chunk index, and total chunk parameters through rotating web infrastructure.
Useful logs: Process, Network
Defense Evasion 07Temporary evidence is removed
Temporary staging, archive, lock, and related artifacts are removed after transfer.
Useful logs: Process, File
Defensive takeaways
Behavior to watch
A user-facing macOS shell launches curl retrieval and native decode or unpack utilities.
The process sequence survives destination changes better than a domain IOC.
Useful logs: Process, Network
curl network traffic uses recurring retrieval, check-in, or upload request shapes across unrelated domains.
Microsoft and RST Cloud both used recurring request shape to expand the infrastructure view.
Useful logs: Network, Process
osascript chains shell or native utilities into retrieval, staging, or cleanup behavior.
The AppleScript-assisted phase connects standard macOS automation with the malicious shell chain.
Useful logs: Process
One process tree accesses multiple Keychain, browser, SSH, cloud, or local credential locations.
Cross-store collection is a stronger signal than one expected browser or Keychain access.
Useful logs: Process, File
Sensitive material is staged under temporary sync paths and compressed before transfer.
Collection followed by temporary staging creates a strong pre-exfiltration pivot.
Useful logs: Process, File
curl performs binary HTTP PUT with upload session, chunk index, and total chunk parameters.
This request shape directly represents active chunked data transfer and persists across domain rotation.
Useful logs: Process, Network
Temporary staging or archive artifacts are deleted soon after suspicious upload activity.
Cleanup reinforces the end-to-end collection and transfer sequence even when disk evidence is short-lived.
Useful logs: Process, File
Logs that help
Endpoint
Device inventory is needed to keep detection and hunt scope on managed Macs.
- macOS platform
- device identity
- current device state
Process
Process telemetry exposes the shell, curl, AppleScript, collection, compression, upload, and cleanup command lines.
- interactive shell with curl retrieval
- osascript chaining native utilities
- credential-store path references
- binary PUT and upload parameters
- post-transfer removal commands
File
File telemetry exposes temporary staging and archive creation or deletion.
- temporary sync staging
- temporary ZIP creation
- post-upload deletion
Network
Network telemetry preserves durable URI/request pivots and destination rotation.
- retrieval URI path
- check-in URI path
- upload session parameter
- chunk index parameter
- total chunk parameter
Defensive takeaways
How to detect this behavior
Rare chunked curl upload on macOS
Detect first-seen macOS curl PUT with binary transfer and all recurring chunk parameters, confirmed by same-process network telemetry.
Logs needed
- DeviceInfo with OSPlatform
- process events with ProcessUniqueId and command line
- network events with InitiatingProcessUniqueId and URL
- historical per-device baseline
Sensitive collection followed by staging and upload
Correlate several credential-store path references with temporary staging/compression and later curl PUT upload.
Logs needed
- process command lines
- file staging telemetry
- network upload telemetry
Defensive takeaways
How to hunt this behavior
Group MacSync infrastructure by request shape
Use recurring retrieval, check-in, and upload URI traits with curl process context before considering a domain related.
What would weaken it
- The destination belongs to an approved application and the exact request template is historically normal.
- The parent process and user role match a known automation workflow.
Correlate credential collection with temporary staging
Multiple credential-store references followed by temporary staging and compression can reveal theft before upload starts.
What would weaken it
- A named backup or migration workflow owns the same paths and archive behavior.
Prioritize chunked binary PUT from curl
Upload session and chunk parameters combined with binary PUT provide a high-value exfiltration pivot that survives domain rotation.
What would weaken it
- The device and destination match an approved chunked-upload application with stable history.
Public reporting
Indicators reported by the source
Values are defanged and are not live links.
RST Cloud confirmed a MacSync loader retrieval from this May 2026 C2 after a customer Jamf Protect block.1 values
- Domain
jacksonvillemma[[.]]com
RST Cloud identified this as the previously disclosed public C2 that preceded the May rotation.1 values
- Domain
glowmedaesthetics[[.]]com
Microsoft lists this as behaviorally related MacSync infrastructure.6 values
- Domain
lalandscapelighting[[.]]com - Domain
lumenagnet[[.]]com - Domain
marbellaresales[[.]]com - Domain
miamipcsupport[[.]]com - Domain
moldinspectiondayton[[.]]com - Domain
nailscanai[[.]]com
Review record
Sources and limitations
- Reviewed
- Reported window
- February 2026 – August 2026
Observation basis
RST Cloud identified URI-pattern-bound infrastructure with observations reaching February 2026 and analyzed an active May 2026 C2 rotation. Microsoft published a broader behavior-led infrastructure and exfiltration analysis on August 18, 2026.
Confidence in this conclusion
Microsoft correlated endpoint and network telemetry across more than thirty related domains and documented collection through exfiltration. RST Cloud independently analyzed a confirmed loader, rapid C2 replacement, recurring URI patterns, and additional candidate infrastructure.
Limitations
- Microsoft's domain list is point-in-time evidence and MacSync infrastructure rotates quickly.
- RST Cloud distinguishes api-key-confirmed infrastructure from URI-pattern-bound candidates; those confidence levels should not be collapsed.
- Native macOS utilities such as curl, zsh, osascript, zip, copy, and removal tools are legitimate and require sequence/context.
- Full sensitive-file read visibility can vary, so process command lines and downstream staging/upload behavior remain important.
- The SOC//LIFE Detection and Hunt are publication-safe defensive reconstructions and were not executed against a customer environment.
Infrastructure changed; behavior did not
RST Cloud documented rapid C2 replacement in May 2026 and used recurring URI structure to identify additional related infrastructure. Microsoft later expanded the behavior-led view across endpoint and network telemetry, connecting more than thirty domains and confirming that the infrastructure supported collection, staging, and active exfiltration rather than simple beaconing.
Durable pivots
The useful pivots are the repeated execution and transfer traits: interactive shell plus curl retrieval, AppleScript-assisted native tooling, credential and browser collection, temporary sync staging, archive creation, binary PUT, upload session and chunk parameters, and post-transfer cleanup.
Defensive lesson
Treat the domain list as point-in-time enrichment. Require multiple behavior traits before relating new infrastructure, and correlate endpoint process context with request shape whenever possible.
- Hunting MacSync Stealer infrastructure through behavioral pivots
Microsoft Security
- MacSync Stealer: C2 Infrastructure Rotation
RST Cloud
- DeviceInfo
Microsoft Learn
- DeviceProcessEvents
Microsoft Learn
- DeviceFileEvents
Microsoft Learn
- DeviceNetworkEvents
Microsoft Learn
Supporting context
ATT&CK mappings
Behavior comes first. These mappings do not imply attribution or complete coverage.
T1059.004· Unix ShellInteractive zsh and Unix shell activity retrieves, decodes, unpacks, and executes payload content.
T1105· Ingress Tool Transfercurl retrieves staged payload content from attacker-controlled web infrastructure.
T1555.001· KeychainThe malware targets macOS Keychain material and browser Safe Storage-related secrets.
T1555.003· Credentials from Web BrowsersBrowser credentials, cookies, login databases, session data, and local browser storage are collected.
T1560.001· Archive via UtilityCollected data is compressed with native utilities before upload.
T1071.001· Web ProtocolsCommand-and-control and upload behavior use web protocols with recurring request paths and headers.
T1041· Exfiltration Over C2 ChannelCollected data is transferred to the active command-and-control infrastructure.
T1020· Automated Exfiltrationcurl automates the binary PUT upload flow.
T1030· Data Transfer Size LimitsThe staged archive is transferred in multiple chunks.
T1070.004· File DeletionTemporary staging, archive, and lock artifacts are removed after exfiltration.