Microsoft Tracks MacSync Stealer by Its Behavior, Not Its Domains
Brief
Microsoft tracked over 30 MacSync Stealer domains by focusing on behavioral patterns, revealing a campaign targeting passwords, keys, wallets and other data.
Domain blocking is a losing game when the thing you’re blocking can register a new domain faster than you can add it to a list. That’s the exact problem Microsoft Defender Experts ran into while tracking MacSync Stealer, a macOS-focused information stealer that RST Cloud first flagged for swapping out its command-and-control infrastructure almost immediately after getting publicly outed.
Microsoft detailed how its experts stopped chasing individual domains and started tracking the behaviors that stayed constant underneath them.
Instead of tracking individual domains, Microsoft looked at recurring request patterns, HTTP headers and other behaviors.