MacSync Stealer Uses Stable URI Patterns and Chunked HTTP PUT Across Rotating C2 Domains
Brief
MacSync Stealer is a macOS-focused information stealer that uses rapidly changing command-and-control (C2) domains to deliver payloads, communicate with infected devices, and steal data.
However, a Microsoft Defender Experts investigation found that the malware keeps several network and execution patterns stable, giving defenders reliable ways to detect activity even after domains change.
Earlier research from RST Cloud identified the malware through a small group of domains and observed fast C2 replacement following public disclosure.
Microsoft later expanded the investigation by correlating endpoint and network telemetry across more than 30 related domains.
The research shows that MacSync Stealer infrastructure supports not only C2 communication but also payload delivery, data staging, and active exfiltration.
The campaign commonly begins with ClickFix-style social engineering.