Reported by 2 outlets

Timeline

1. update from cyberpress.org

   MacSync Stealer Uses 30+ Rotating Domains to Steal macOS Credentials and Exfiltrate Data

   cyberpress.org · 55d ago · August 19th, 2026

   MacSync Stealer, a macOS-focused information-stealing malware, has been linked to more than 30 rotating domains used for payload delivery, command-and-control (C2), and data exfiltration. Earlier research from RST Cloud identified a smaller set of malicious domains and noted that operators rapidly replaced C2 infrastructure after it was publicly exposed. Microsoft Defender Experts have now expanded the investigation by tracking recurring endpoint and network behaviors rather than relying only on domain indicators. The campaign reportedly begins with ClickFix social-engineering lures. Victims are persuaded to paste and run malicious commands in Terminal, launching an interactive zsh shell session. The commands use curl to retrieve attacker-controlled payloads, then decode or unpack them with native utilities such as Base64 and gunzip . MacSync Stealer uses AppleScript through osascript to launch shell commands and perform follow-on activity. It uses common macOS tools including sh , cp , rm , mkdir , curl , and killall , helping it blend into normal system activity. MacSync Stealer’s 30-Domain Theft Once active, the stealer gathers system and user information before searching for valuable data. Its targets include macOS Keychain-related material, browser Safe Storage keys, browser passwords, cookies, login databases, session data, browsing history, IndexedDB, LevelDB, extension storage, Safari information, and Apple Notes. The malware also attempts to steal SSH keys, AWS crede

2. update from gbhackers.com

   Microsoft Links 30+ Domains to MacSync Stealer’s Credential-Theft and Data-Exfiltration Infrastructure

   gbhackers.com · 55d ago · August 19th, 2026

   The investigation shows why defenders should prioritize repeatable endpoint and network behavior over static domain-based detections. Observed executions originate from interactive zsh sessions and use curl to fetch payloads from […] The post Microsoft Links 30+ Domains to MacSync Stealer’s Credential-Theft and Data-Exfiltration Infrastructure appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

3. update from gbhackers.com

   MacSync Stealer Uses 30+ Rotating Domains to Steal macOS Credentials and Exfiltrate Data

   gbhackers.com · 54d ago · August 20th, 2026

   MacSync Stealer is expanding its macOS-focused theft operation through a rotating network of more than 30 domains, using stable execution and network patterns to steal credentials, browser data, cloud access keys, SSH material, and sensitive user files.