Microsoft Links 30+ Domains to MacSync Stealer’s Credential-Theft and Data

Gbhackers •Mayura Kathir • August 19, 2026

More than 30 domains tied to MacSync Stealer, exposing a rotating macOS-focused infrastructure that supports payload delivery, command-and-control, credential theft, staging, and chunked data exfiltration. The investigation shows why defenders should prioritize repeatable endpoint and network behavior over static domain-based detections. Observed executions originate from interactive zsh sessions and use curl to fetch payloads from […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Identifies Over 30 Domains Linked to MacSync Stealer Malware Microsoft has linked more than 30 rotating domains to the MacSync Stealer, a malware targeting macOS systems. This infrastructure supports various malicious activities, including credential theft and data exfiltration. The malware operates through interactive zsh sessions and utilizes curl to fetch payloads. The investigation emphasizes the need for defenders to focus on behavioral detection methods rather than solely relying on static domain-based approaches. The ongoing threat poses risks to users of macOS devices, highlighting the necessity for enhanced security measures. 4 sources 52

Extracted Entities

Microsoft Links 30+ Domains to MacSync Stealer’s Credential-Theft and Data

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)

Tools (2)