Microsoft Identifies Over 30 Domains Linked to MacSync Stealer Malware

Microsoft has linked more than 30 rotating domains to the MacSync Stealer, a malware targeting macOS systems. This infrastructure supports various malicious activities, including credential theft and data exfiltration. The malware operates through interactive zsh sessions and utilizes curl to fetch payloads. The investigation emphasizes the need for defenders to focus on behavioral detection methods rather than solely relying on static domain-based approaches. The ongoing threat poses risks to users of macOS devices, highlighting the necessity for enhanced security measures.

Key Points: • Over 30 domains associated with MacSync Stealer malware identified by Microsoft. • Malware targets macOS systems, facilitating credential theft and data exfiltration. • Defenders advised to prioritize behavioral detection over static domain monitoring.