Microsoft Defender Experts have published new details on MacSync Stealer. The macOS-focused information stealer uses changing infrastructure to deliver payloads, communicate with compromised devices, and exfiltrate data. For companies that run Macs, the important point is that Microsoft does not only list domains. It describes recurring behavioral pivots that security teams can hunt for in Microsoft Defender and Defender XDR.
What Microsoft observed about MacSync Stealer
According to Microsoft, the observed activity starts from an interactive zsh session consistent with ClickFix social engineering: users are tricked into pasting or running commands in Terminal. The session then uses curl to retrieve payload content, which is decoded or unpacked with native tools such as Base64 and gunzip. AppleScript-assisted shell commands through osascript, further network communication, and data collection follow.
Microsoft describes the investigation as behavior-led. The researchers correlated process, command-line, file, and network telemetry rather than relying on individual domains. That approach connected more than 30 related domains, but the key signal was the repeated pattern across payload retrieval, command-and-control communication, staging, and exfiltration.
Why domains alone are not enough
MacSync Stealer rotates infrastructure quickly. Microsoft therefore presents domains as point-in-time evidence, not as the only basis for detection. The more durable signals are the technical traces created by the attack flow:
/curl/as the path for initial payload retrieval./dynamic?txd=and/gate?buildtxd=as recurring URI patterns.upload_id,chunk_index,total_chunks, API-key headers, and HTTP PUT uploads with--data-binary.
For defenders, the practical message is clear: blocklists can help, but they should not be the only response. Teams that only block domains lose visibility as infrastructure changes. Teams that combine process context with request shape can investigate new domains that show the same behavior.
What data the stealer collects
Microsoft lists a broad collection of local data on macOS devices. It includes Keychain-related material, browser Safe Storage keys, browser credentials, cookies, login databases, session data, IndexedDB, LevelDB, extension storage, Safari data, Apple Notes, SSH keys, AWS credentials, Kubernetes configurations, browser profiles, browsing history, and sensitive files from common user directories.
According to Microsoft, the data is staged under temporary paths such as /tmp/sync*, compressed into /tmp/osalogging.zip, split into multiple chunks, and uploaded by curl over HTTP PUT. After exfiltration, the malware removes temporary archives, staging folders, lock files, and other artifacts. This sequence of access, archiving, upload, and deletion is an important correlation opportunity.
What Defender XDR can detect
Microsoft lists several detections in Microsoft Defender for Endpoint and Microsoft Defender Antivirus. They include suspicious shell execution, AppleScript activity, file obfuscation, sensitive-file access, archive creation, possible exfiltration using curl, and macOS-specific detections such as Trojan:MacOS/SuspMacSyncExfil. Defender XDR also provides Threat analytics information for customers with provisioned access.
Microsoft also publishes Advanced Hunting queries as starting points. They search for curl network events with the URI paths above, HTTP PUT uploads with --data-binary, process command lines that contain API-key headers, and osascript activity launching shell tools such as sh, cp, rm, curl, mkdir, or killall.
What teams should review now
Microsoft’s protection guidance is concrete enough for a short internal review, especially where Macs are used for daily work:
- Warn users about ClickFix patterns and prohibit pasting untrusted Terminal commands.
- Monitor unusual Terminal, zsh, and shell sessions followed by downloads or decoding activity.
- Review unusual sequences involving
curl, Base64, gunzip,osascript,cp,rm,mkdir, andkillall. - Correlate access to Keychain material, browser credentials, SSH keys, cloud credentials, and sensitive user files.
- Check Cloud-delivered Protection, Network Protection, Web Protection, and Tamper Protection for Defender on macOS.
For small and midsize businesses, this does not have to become a separate project. It is a useful operational checkpoint: are Mac endpoints fully onboarded to Defender, do their signals arrive in Defender XDR, and have the hunting queries been tuned to local allowlists?
Official Microsoft sources
- Microsoft Security Blog: Hunting MacSync Stealer infrastructure through behavioral pivots
- Microsoft Learn: Network protection and web protection for macOS
- Microsoft Learn: Set preferences for Microsoft Defender for Endpoint on macOS
Whether your Mac endpoints produce the relevant Defender signals and whether hunting rules work without too much noise is something we review as part of a Microsoft Security Assessment – get in touch.
What does this mean for your environment?
Assess the topic in the context of your Microsoft 365 environment and define a practical next step.
You speak directly with Sebastian Kerssen – working in the Microsoft ecosystem since 2014, with personal consulting and a dedicated point of contact.
