CTI · corroborated · 2026-08-19

Microsoft Links 30+ Domains to MacSync Stealer's Credential-Theft and Data-Exfiltration Infrastructure

Full story & timeline

MITRE ATT&CK

• T1566 Phishing Initial Access
• T1204 User Execution Execution
• T1059 Command and Scripting Interpreter Execution
• T1555 Credentials from Password Stores Credential Access
• T1185 Browser Session Hijacking Collection
• T1041 Exfiltration Over C2 Channel Exfiltration

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: MacSync Stealer ClickFix osascript Curl Payload Delivery
id: a8f3c2d1-7e4b-4a9f-b6c5-d12345678901
status: experimental
description: >
    Detects osascript executing shell commands that invoke curl to fetch
    attacker-controlled payloads, as observed in the MacSync Stealer
    ClickFix campaign (Microsoft Defender Experts, August 2026). Victims
    are lured via social engineering to paste malicious commands into
    Terminal, launching an interactive zsh session that uses curl to
    retrieve payloads and osascript to perform follow-on AppleScript
    activity including credential theft and data exfiltration.
references:
    - https://gbhackers.com/microsoft-links-30-domains/
    - https://cyberpress.org/macsync-stealers-30-domain-theft/
author: Tia N. List
date: 2026/08/19
tags:
    - attack.t1059
    - attack.t1566
logsource:
    category: process_creation
    product: macos
detection:
    selection_osascript_curl:
        Image|endswith: '/osascript'
        CommandLine|contains|all:
            - 'curl'
            - 'http'
    selection_zsh_curl_osascript:
        Image|endswith: '/zsh'
        CommandLine|contains|all:
            - 'curl'
            - 'osascript'
    condition: selection_osascript_curl or selection_zsh_curl_osascript
falsepositives:
    - Legitimate automation scripts using osascript with curl for system administration
    - Developers building AppleScript-based tools that fetch remote resources
level: high

References

• https://gbhackers.com/microsoft-links-30-domains/
• https://cyberpress.org/macsync-stealers-30-domain-theft/