MacSync Stealer is expanding the risk facing Mac users by turning everyday web browsing and Terminal activity into a route for password theft. The macOS-focused malware uses short-lived online infrastructure, making simple blocklists less effective and leaving victims exposed to account theft, financial loss, and disclosure of private files.

The campaign begins with ClickFix social engineering, persuading victims to paste a command into Terminal after encountering a fake verification, download, or support prompt. Microsoft researchers have now tied more than 30 domains to the operation by focusing on behavior rather than individual addresses.microsoft

Key Details

The impact reaches far beyond a single saved password. MacSync searches for browser data, Keychain material, cloud and SSH credentials, wallet-related artifacts, Apple Notes, session information, and files stored in common folders. Those records can give criminals access to personal accounts or provide a foothold into business environments.

Microsoft said in a report that it tracked the activity from command-and-control contact through data collection, temporary storage, and theft. Its researchers found that recurring network and execution traits tied the operation to more than 30 domains despite rapid infrastructure changes.microsoft

The operator’s domain rotation is central to the campaign. When one address is reported or blocked, another can be used to deliver the payload, receive check-ins, or collect stolen archives. This approach complicates investigations that depend only on known malicious domains.microsoft

Technical Analysis

Microsoft connected the servers through repeatable behavior. It observed the same request paths, Mac-style browser identifiers, API-key headers, curl options, and chunked uploads across different domains. This gave defenders a stronger way to recognize the campaign because the surrounding activity stayed similar even when the web address changed.microsoft

Once launched, MacSync uses built-in macOS tools to keep its actions close to normal system activity. It starts from an interactive zsh session, uses curl to fetch content, and can rely on Base64, gunzip, and AppleScript-assisted commands to unpack and run it. The tactic echoes a Script Editor ClickFix campaign that sought to sidestep user safeguards.reddit

The malware then gathers high-value information from browsers and the local system. It checks for Ledger and Trezor-related data, takes browser credentials and cookies, and looks for keys, configuration files, and sensitive documents. It also examines downloads, documents, and desktop locations for file types that may contain passwords, recovery material, or business information.

After collection, MacSync stores the material in temporary folders and compresses it into an archive before sending it out. The archive is divided into smaller pieces and uploaded through HTTP PUT requests, then the malware removes temporary files and folders. This sequence confirms theft rather than routine contact with a remote server.microsoft

Why It Matters

The campaign matters because it targets the very tools and workflows Mac users trust: Terminal, browsers, Keychain, and cloud services. A single pasted command can lead to:

• Loss of browser and application passwords.
• Exposure of SSH keys and cloud credentials.
• Theft of cryptocurrency wallet data.
• Compromise of personal and business files.
• Lateral movement into corporate environments.

The use of more than 30 rotating domains makes signature-based blocking less reliable. Microsoft’s approach shows why behavioral hunting is essential for modern macOS threats.

Expert Recommendations

For security teams, the useful signal is the full chain rather than one suspicious domain. An unusual Terminal or shell session followed by curl downloads, AppleScript activity, access to password stores, archive creation under temporary paths, and outbound uploads should be investigated together.

Users should never paste commands into Terminal from websites, chat messages, apps, files, or telephone instructions they do not fully trust. Organizations should teach staff to recognize these lures, watch for unexpected shell and osascript activity, and investigate curl traffic that uploads data.

Recommended actions:

• Do not paste Terminal commands from untrusted sources.
• Treat fake CAPTCHA, download, or support prompts as suspicious.
• Monitor for unusual Terminal, zsh, and osascript activity.
• Investigate curl traffic with API-key headers and chunked PUT uploads.
• Restrict suspicious outbound connections where possible.
• Protect password stores and Keychain access.
• Keep macOS and security tools updated.
• Review alerts involving data staging and exfiltration.
• Reset affected passwords from a clean device.
• Revoke active sessions and replace exposed cloud or SSH credentials.

Apple’s newer protections can warn users about potentially harmful Terminal pastes and stop known malicious scripts, but they are not a substitute for caution. Any suspected compromise warrants revoking active sessions and replacing exposed credentials.

Industry Context

Similar credential-focused threats, including the new macOS crash report stealer, show why such linked evidence matters. The MacSync campaign fits a broader trend in which attackers abuse legitimate macOS tools and social engineering to bypass traditional defenses.microsoft

The campaign also illustrates how ClickFix operations are evolving. Earlier variants served lures openly, while newer infrastructure uses server-side fingerprinting to hide malicious content from crawlers and sandboxes, revealing it only to visitors who appear to be genuine macOS targets.microsoft+1

Conclusion

MacSync Stealer shows how a simple social-engineering trick can become a full credential-theft operation when combined with domain rotation and behavioral stealth. For Mac users, the safest rule is clear: never paste commands into Terminal from untrusted sources.

FAQ SECTION

What is MacSync Stealer?

MacSync Stealer is a macOS-focused information stealer that targets browser data, Keychain, cloud and SSH credentials, and cryptocurrency wallet artifacts.

How does the attack start?

The campaign begins with ClickFix social engineering that persuades victims to paste a command into Terminal, often after a fake verification or download prompt.

Why are 30+ domains important?

The operator rotates domains to evade blocklists, making behavioral hunting more effective than relying on individual malicious addresses.

What data does MacSync steal?

It collects browser credentials, cookies, Keychain material, cloud and SSH keys, wallet-related data, Apple Notes, and sensitive files.

How can users protect themselves?

Never paste Terminal commands from untrusted sources, keep macOS updated, monitor for unusual shell and AppleScript activity, and reset credentials from a clean device if compromise is suspected.